5 ms·
Does anyone know why they might choose to encrypt-then-MAC vs. an AEAD scheme? Seems less error prone.
by modalduality 9y ago
Does anyone know why they might choose to encrypt-then-MAC vs. an AEAD scheme? Seems less error prone.
- dom0 9y agoNothing error prone about EtM.
- tuxxy 9y agoThere's nothing error prone about choosing to do Encrypt-then-MAC, but there could be some issues with how they implemented AES-CTR. Plain and simple, there is just more room to make a grave mistake.
- dom0 9y agoI'll assume that restic does not actually implement AES. I maintain that rolling EtM is effectively not more error prone than correctly using a dedicated AEAD construction, since in either case you are rolling your own crypto, which swamps error proneness differences between these alternatives.
- tptacek 9y agoI'm not sure I follow this. A library implementation of an AEAD, with "Seal" and "Unseal" functions, is almost misuse-resistant (depending on the primitive and how they handle nonces). The same is not true of a library that exports AES-CTR or AES-CBC's Encrypt/Decrypt, plus a MAC! If you're implementing an entire AEAD construction, like GCM or EAX, from scratch, then yes. Don't do that. You probably are safer composing CBC and HMAC than you would be writing your own EAX. But if your library exports an EAX, using it is almost certainly a huge security win over DIY authenticated encryption, even if you can remember the order of operations properly.
- tedunangst 9y agoWell, in comparison, there are plenty of opportunities for grave mistakes with AES-GCM.
- azinman2 9y agoPointers?
- wolf550e 9y agoNonce reuse
- kaoD 9y agoWell that's a gotcha on AES-CTR too. GP is asking about mistakes that could happen on AES-GCM that won't happen with AES-CTR+HMAC. I'm no crypto expert, but I'd say there are more opportunities of messing up with AES-CTR+HMAC like forgetting to MAC the IV.
- tedunangst 9y agoNonce reuse for CTR gives you the plaintext of those messages. (Well, the XOR of them, from which you can probably figure out the rest.) Nonce reuse for GCM gives up the key.
- azinman2 9y agoIsn’t that a gotcha for anytime you’d use a nonce? Meanwhile PubNub is using a hard coded IV on every message in ECB and CBC modes :) https://github.com/pubnub/javascript/blob/master/src/core/components/cryptography/index.js https://github.com/pubnub/javascript/blob/master/src/core/co...
- colmmacc 9y agoIt's not really a "vs" thing. EtM is implementation of AEAD.
- tptacek 9y agoNo, that's not accurate. EtM is an implementation technique. AEAD is a cryptographic primitive service model. The concepts aren't directly comparable. In particular: you can easily end up with AE w/o AD by doing DIY ETM, and end up with serious exploitable bugs.
- iofiiiiiiiii 9y agoCan you go into more detail? What are the common gotchas when implementing ETM yourself?
- tptacek 9y agoThe classic example is not MAC'ing the IV.
- loup-vaillant 9y agoWait a minute, there are cases where this is required? Chacha20/Poly1305 is not one of them, right? --- Another I have personally seen was using the session key for a Wegman Carter hash (such as Poly1305). I received an email suggesting I do just that in Monocypher, to avoid using up the beginning of the key stream. Didn't realise why this would lead to instant key recovery. I have since littered my manual with scary tales of total annihilation of security.