3 ms·
A lot of those criticisms are sort of unfair. For example, pointing out length extension attacks in a fabricated MAC construction not found in the article, espe
by oconnore 10y ago
A lot of those criticisms are sort of unfair. For example, pointing out length extension attacks in a fabricated MAC construction not found in the article, especially when the OP explicitly recommends blake2b, which is not vulnerable to length extension (and also disclaims "How that magical MAC is built is beyond the scope of this paragraph.").
Another example: criticizing that he mentions appending a MAC (you should choose an AEAD!)... when later he recommends using an AEAD.
- dom0 10y agoAEAD normally only means actual AEAD constructions (think AES-GCM/OCB, Chacha20-Poly1305 - not combinations of primitives providing authentication (=EtM, eg. first encrypt with AES-CTR then MAC with some HMAC). But yeah, some of the criticism reads kinda nit-picky / "I'm going to find false things in here". But on the other hand he provides good hints how the article could be improved.
- oconnore 10y agoThe article recommends Chacha20 Poly1305, not some combination of primitives.
- dom0 10y agoWhat do you mean by this then? > Another example: criticizing that he mentions appending a MAC (you should choose an AEAD!)... when later he recommends using an AEAD.
- oconnore 10y agoThere is a section called "integrity: not optional", where he uses MACs (which I would consider to be conceptually simpler to understand than AEADs) to explain how integrity can be implemented. Later, in a section called "Level 2: choosing crypto", he recommends using ChaCha20 Poly1305. Anyway, this isn't really my crusade, I just think that if you read the informal blog post as an informal blog post, it's fine.
- lvh 10y agoI think the criticism is still valid: combining a MAC and cipher into an AE scheme (especially an AEAD scheme) is anything but trivial. For example, I don't think it's reasonable to suggest someone would, given those two tools, end up with the moral equivalent of secretbox but with ChaCha20 replacing XSalsa20. (At least there's not a padding timing differential for MtE, but still.)
- mfukar 10y agoThere is no fairness in cryptography, only math.
- loup-vaillant 10y ago> A lot of those criticisms are sort of unfair. Possible, but my readers aren't fair either. If I phrase stuff the wrong way, someone might go off and do something stupid. In a similar vein, one that stops reading at level 1 will miss my AEAD recommendation at level 2. Were they asking for it, or should I have put the recommendation earlier? Tough call.