Re: [TLS] Encrypt-then-MAC again (was Re: padding bug)

[Bodo Moeller <[e-mail]>]

>
>
> > http://www.ietf.org/mail-archive/web/tls/current/msg10004.html
> >
> > (That said, Nikos' complaint seems bogus to me.  Peter's proposal
> > seems fine from a security point of view -- as long as clients refuse
> > to unnecessarily roll back to SSL 3.0, e.g. using
> > draft-bmoeller-tls-downgrade-scsv-01 --, the question is just if it's
> > worth the extra complexity given the other options.)
>
> I think there is some confusion over that. It was a suggestion rather
> than a complain; and is not a stopper for such a draft.


Thanks for clarifying!


> The fact that
> MAC truncation is known to improve security (for HMAC-MD5 and
> HMAC-SHA1), does not render non-truncation insecure (as many have
> pointed out -including me - there are no known practical attacks against
> HMAC-MD5 and HMAC-SHA1).
>

It's also not actually a known fact that MAC truncation will improve
security.  While there are certain (hypothetical) advantages, there are
also certain (more concrete) disadvantages.  As the HMAC RFC puts it (RFC
2104): "The results in this area are not absolute as for the overall
security advantages of truncation."

Bodo