Re: [TLS] Encrypt-then-MAC again (was Re: padding bug)

On Fri, Nov 29, 2013 at 10:13 AM, Nikos Mavrogiannopoulos
<nmav@redhat.com> wrote:
> On Fri, 2013-11-29 at 09:26 -0800, Robert Ransom wrote:
>
>> > You have been quite clear about that, and I've got the impression that you
>> > are the only but very vocal opponent of encrypt-then-mac on this list.
>>
>> Nikos Mavrogiannopoulos has also been opposed to encrypt-then-HMAC.  I
>> don't know of any others.
>
> It seems I'll have to repeat that. I don't oppose this draft. I prefer
> an alternative [1], which was not mentioned in the IETF88 meeting. So if
> the question would be AEAD (i.e, not a fix) or encrypt-then-mac, I'd go
> with the latter. If the question is [1] or encrypt-then-mac I'd go with
> the former.
Why do you prefer this alternative?
AEAD is a fix, provided we deploy it. But that isn't happening for
whatever reason.
I suspect that we will soon learn that all fixes do not get deployed
for mysterious reasons.
Solution: get it right the first time.
>
>> > I'm sure you have good reasons for this opposition, so could you
>> please
>> > explain them in one or two sentences. This excluding the "encrypting
>> the
>> > HMAC makes it safer" argument, which might be true but as I
>> understand is
>> > not well proven.
>> "not well proven" is the wrong phrase here.  Marsh Ray solidly
>> debunked it.
>
> I don't quite understand that. No-one questioned his observations in any
> point at any previous discussion. Please review them to understand where
> I stand.
So if HMAC is only a universal hash then HMAC followed by counter mode
is secure, but
HMAC followed by CBC is secure up to a collision of the chaining
value. This analysis assumes
the HMAC falls in a block.

But remember HMAC is essentially H(k||H(k||m)). In particular if the
H(k||m) is a universal hash function,
and H(k||..) satisfies some sort of keyed security assumption (PRF for
fixed length?) HMAC is secure.

So the only way HMAC followed by encrypt is more secure than encrypt
followed by HMAC is if things
break in a really weird way.
Sincerely,
Watson Ladd
>
> regards,
> Nikos
>
> [1].
> http://tools.ietf.org/search/draft-mavrogiannopoulos-new-tls-padding-01
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin