Re: [TLS] Comments/Questions on draft-gutmann-tls-encrypt-then-mac-00.txt

["Christian Kahlo" <[e-mail]>]

Nikos,

> > This has some interesting parallels with FIPS 140-2. Currently the
> only approved
> > symmetric algorithms for FIPS 140-2 and TLS are AES-GCM, AES-CBC and
> DES3-CBC.
> > If you can't deploy TLS 1.2 you're then stuck with CBC.
> [...]
> > spec, as it doesn't need any new algorithms, could be
> > deployed as soon as it is approved.
> >
> > I'm not saying that we don't approve new algorithms and ciphers
> suites. I'm
> > saying we need ETM as well.
> 
> What we need is a solution for the issue with the unauthenticated
> padding in the CBC ciphersuites. ETM is not the only way to solve the
> issue, and even if it is used, it would be highly recommendable to
> follow the existing good practices. TLS isn't the first protocol to use
> this mode, thus there isn't a need to innovate.

maybe you want to read http://cseweb.ucsd.edu/~mihir/papers/oem.pdf
and http://www.iacr.org/archive/crypto2001/21390309.pdf.
Both mentioned within this thread:
http://crypto.stackexchange.com/questions/202/should-we-mac-then-encrypt-or-
encrypt-then-mac

Please tell us which protocols are still using Mac-then-Encrypt today
without running into any security trouble (esp. chosen ciphertext
attacks). MtE is considered as a design fail by many researchers.

As we discussed earlier AEAD might be a solution, but AEAD is not the
only one. I would encourage everbody to also have a look into
ISO7816-4 secure messaging. That's the way most electronic ID cards,
electronic purse cards, credit cards, small HSMs, etc. do communicate.
And now think about that there's a reason for that it's an EtM-
scheme.

Sorry, your attitude "there isn't a need to innovate" sounds
somewhat unfamiliar with cryptographic primitives to me.

Cheers,
Christian