3 ms·
But when CBC is used correctly (with authentication), then one could just as well use CTR and get a nice performance improvement. The differences between these
by blattimwind 8y ago
But when CBC is used correctly (with authentication), then one could just as well use CTR and get a nice performance improvement. The differences between these two (IV reuse, malleability) only become relevant when they're used incorrectly in the first place.
- tptacek 8y agoI would probably generally use CTR? But you can chop this up in different ways; CTR is faster than CBC, and slightly less code to implement, but CBC (assuming EtM) fails less catastrophically than CTR if initialized improperly. CBC+HMAC-SHA2 is probably the safest thing you can implement from scratch. People should just use Tink or Nacl though.