3 ms·
Is it really HMAC’d? 8 bytes isn’t cryptographic protection. It may be secure, but the standard arguments don’t apply.
by garmaine 7y ago
Is it really HMAC’d? 8 bytes isn’t cryptographic protection. It may be secure, but the standard arguments don’t apply.
- tptacek 7y agoWrite a sketch of how a padding oracle attack would work against a CBC-encrypted message authenticated with truncated HMAC.
- CiPHPerCoder 7y agoIt's like a standard padding oracle attack, but 4 billion times slower (on average) and requires 4 billion times more CPU work and bandwidth, and you have to be able to distinguish between a HMAC failure and a padding error. (a.k.a. isn't happening)