Re: [TLS] Encrypt-then-MAC again (was Re: padding bug)

On Wed, Dec 4, 2013 at 9:51 PM, Trevor Perrin <trevp@trevp.net> wrote:
> I'd like to add a vote for Peter's draft, along with (I believe)
> Wan-Teh, Robert Ransom, Juho Vähä-Herttua, and others.
>
> Some small objections have been raised which I believe can be countered:
>
>  * Nikos prefers Mac-then-Encrypt over the reverse, but otherwise
> supports this. [1]
>
>  * Adam Langley has "no objection" to this, but prefers to focus on
> AES-GCM and ChaCha20 [2].  Browsers are very concerned with speed, so
> it's not surprising they prefer CTR-and-polynomial-MAC ciphersuites.
> However, TLS is used places besides the browser, and I suspect many of
> the smaller TLS libraries (such as those by Nikos, Peter, or myself)
> would prefer smaller code changes.  Also, Peter's draft easily
> upgrades security for all versions of TLS, and less-common
> ciphersuites like TLS-SRP and TLS-PSK.
AGL's opposition was mine, but given the reasoning Trevor presents I
would like to put my
vote behind Peter's draft.
>
>
> Trevor
>
>
> [1] http://www.ietf.org/mail-archive/web/tls/current/msg10736.html
> [2] http://www.ietf.org/mail-archive/web/tls/current/msg09826.html
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls


-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin