4 ms·
Poly1305 also fails if nonces are repeated. If you want reuse resistance, I'd rather go for something boring like encrypt-then-HMAC than a polynomial based MAC.
by tveita 11y ago
Poly1305 also fails if nonces are repeated. If you want reuse resistance, I'd rather go for something boring like encrypt-then-HMAC than a polynomial based MAC.
- tptacek 11y agoIt does (really: everything that wasn't designed with misuse resistance as a primary goal does) --- I was imprecise. Sorry. Unfortunately, "encrypt-then-HMAC" doesn't save you from this problem; you'll either be encrypting with CBC (which loses security if IVs are predictable) or CTR (which blows up if they do). What you won't lose when that happens, though, is forgery resistance. A good starting point for misuse-resistant authenticated encryption is SIV.