2 ms·
Is it the last step of the encrypt function which would need an additional XOR operation added (XEX va XE for the encryption of the tag) to mitigate this attack
by zaroth 8y ago
Is it the last step of the encrypt function which would need an additional XOR operation added (XEX va XE for the encryption of the tag) to mitigate this attack? [1]
S3(delta);
XOR(tmp, delta, checksum);
AESencrypt(tmp, tag, &encrypt_key);
[1] - https://crypto.stackexchange.com/a/63642 https://crypto.stackexchange.com/a/63642
- lvh 8y agoThe cryptographic answer is: yep, that sounds about right (with low confidence because the model violation is subtle). The cryptographic engineering answer is: use OCB3 instead which doesn't have this problem :)