Re: [TLS] TLS1.3

[Nikos Mavrogiannopoulos <[e-mail]>]

On 02/08/2013 02:03 PM, Paterson, Kenny wrote:

>> There is nothing wrong with MAC-then-encrypt,

> 
> I disagree. The paper by Bellare and Namprempre from Asiacrypt 2000
> and Hugo Krawczyk's paper from Crypto 2001 both demonstrate good
> reasons to be suspicious of MAC-then-encrypt from a theoretical
> perspective.


It could be, and I cannot offer any insight on whether these theoretical
weaknesses, have any practical effect.

However, the switch from MAC-then-Encrypt to Encrypt-then-MAC mode of
operation is a radical move that does not affect only the CBC ciphers
(e.g. RC4-SHA1 is also MAC-then-Encrypt).

> And in practice, time and again it's proven to be problematic. And

> not just in TLS (see for example my paper with Jean Paul Degabriele
> at ACM-CCS 2010 about MAC-then-encrypt configurations of IPsec.
> TL;DR: we broke them all).


I understand, and such attacks can indeed occur if there are encrypted
data that are left unauthenticated by the MAC (e.g., as the pad is in
TLS now). My sentence referred to a MAC-then-encrypt operation that
encrypts and authenticates all data (including any pads).

regards,
Nikos