Re: [TLS] rfc7366: is encrypt-then-mac implemented?

[Manuel Pégourié-Gonnard <[e-mail]>]

On 30/10/2014 11:44, Peter Gutmann wrote:
> Manuel Pégourié-Gonnard <[e-mail]> writes:
> 
>> Sure, I'd never think of doing that. But I can certainly tell my code to
>> compute
>>
>>  MAC_k( seq_num + type + version + length + encrypted_stuff )
>>
>> with length != length_of(encrypted_stuff). After all, for the MAC function,
>> what we call "length" is just two meaningless bytes.
> 
> Oh, so the issue isn't that you're MAC'ing extra stuff that isn't there, but
> that you're using a length value that includes stuff that isn't MAC'd?  In
> other words in the above 'length' isn't 'length of encrypted_stuff that
> follows the length value' but 'length of encrypted_stuff that follows the
> length value + length of MAC'?
> 
Precisely. It looks like we're making progress in undertanding each other.

(As a side point (since I'm not arguing that what I'm doing is The Right Thing
do to, rather that it's unclear from the text of the RFC), both options look
completely equivalent to me from a security point of view, since one needs to
know the length of the MAC to check it, anyway.)

Manuel.