Re: [TLS] TLS Proxy Server Extension

[David McGrew <[e-mail]>]

On Aug 1, 2011, at 9:50 AM, Martin Rex wrote:

> David McGrew wrote:
>>
>> That property does not hold for any use of authenticated encryption,
>> including that of RFC 5288 or the two drafts using CCM.
>
>
> Which means that security-wise those cipher suites are substantially
> weaker than tls cipher suites which provide encryption and integrity
> by independent means.

calling authenticated encryption "weaker" is wrong.  I believe what  
you mean to say is that it doesn't have this side property that you  
think is important.  Perhaps it is important, but it is not security  
property.  Historically, several real world protocols and systems have  
weakness due to poor design decisions with respect to combining  
authentication and encryption, and the use of AEAD prevents that sort  
of problem.

As a side note: AEAD algorithms could be designed that have the  
property that you want, and in fact Ken Grewal and Men Long proposed  
exactly such a thing as a variant of GCM; see draft-grewal-aes-gcm- 
bifurcated-key-00.

David