You're much more qualified than I am, but I was talking about cases where there are bugs in the MAC layer. For instance, t's possible that the constant-time co

You're much more qualified than I am, but I was talking about cases where there are bugs in the MAC layer. For instance, t's possible that the constant-time comparison code is well tested on a processor with constant time comparison of a 64-bit register with zero, but ends up being run on some oddball ultra-low power processor that uses one cycle for each leading zero byte in the register, or something. Using CBC potentially allows an attacker to leverage a timing attack against the MAC into a plaintext disclosure via padding oracle. Granted, this scenario requires multiple cascading bugs, but that's kind of the point of Inferno. In general, one is well advised to use the most well-tested and standard algorithms, but CTS is very close to CBC. Have you specifically seen any CTS implementation bugs?