Re: [TLS] Encrypt-then-HMAC is the only credible choice. Here's why:

[Bodo Moeller <[e-mail]>]

>
> Yeah, I didn't mean to imply so much that HMAC is the One True MAC or that
> integrated AE modes can never be defensible. Just that
> MAC-(then|and)-Encrypt are broken while Encrypt-then-HMAC is a very
> conservative design which has stood the test of time and emerged victorious.



 See: https://twitter.com/elwoz/status/401135814307889152
> Figure 2 from http://eprint.iacr.org/2000/025
>
>
While you are right, http://eprint.iacr.org/2000/025 alone isn't why MtE is
broken (and https://twitter.com/marshray/status/401147046767239169/photo/1thus
is a gross over-simplification -- not that there's anything wrong with
that, per se ...).

That Bellare/Namprempre paper did show that MtE is not *generically*
secure.  However, there's also http://eprint.iacr.org/2001/045 =
http://www.iacr.org/archive/crypto2001/21390309.pdf, showing (sort of) that
MtE *is* secure if E specifically is, for example, CBC encryption.  Well,
we all know how well *that* went [*][**] ... but the various problems with
CBC ciphersuites are not implied by the Bellare/Namprempre paper.

[*] See Paterson/Watson, "Authenticated-Encryption with Padding: A Formal
Security Treatment", 2011, for a more complete truth.  That article is
behind a paywall, but Kenny conveniently provided this pointer to Gaven's
thesis: http://www.isg.rhul.ac.uk/~kp/theses/GWthesis.pdf

[**] I must have my hand-written slides somewhere ...
http://www.iacr.org/conferences/crypto2002/rump-prog.html

Bodo