Re: [TLS] Encrypt-then-MAC again (was Re: padding bug)

[Trevor Perrin <[e-mail]>]

I'd like to add a vote for Peter's draft, along with (I believe)
Wan-Teh, Robert Ransom, Juho Vähä-Herttua, and others.

Some small objections have been raised which I believe can be countered:

 * Nikos prefers Mac-then-Encrypt over the reverse, but otherwise
supports this. [1]

 * Adam Langley has "no objection" to this, but prefers to focus on
AES-GCM and ChaCha20 [2].  Browsers are very concerned with speed, so
it's not surprising they prefer CTR-and-polynomial-MAC ciphersuites.
However, TLS is used places besides the browser, and I suspect many of
the smaller TLS libraries (such as those by Nikos, Peter, or myself)
would prefer smaller code changes.  Also, Peter's draft easily
upgrades security for all versions of TLS, and less-common
ciphersuites like TLS-SRP and TLS-PSK.


Trevor


[1] http://www.ietf.org/mail-archive/web/tls/current/msg10736.html
[2] http://www.ietf.org/mail-archive/web/tls/current/msg09826.html