3 ms·
> A good MAC algorithm doesn't leak anything about the plaintext. Though this may be true for specific MAC algorithms, it's a very dangerous and incorrect assu
by just-ok 6y ago
> A good MAC algorithm doesn't leak anything about the plaintext.
Though this may be true for specific MAC algorithms, it's a very dangerous and incorrect assumption to hold in general. MACs are designed for integrity and nothing more.
- Nursie 6y agoFair enough, also not really at issue when we're talking about encrypt-then-mac I guess.
- just-ok 6y agoYep! Absolutely true, and one of the reasons why Encrypt-then-MAC is the only generic composition method scheme that always provides certain security properties (specifically, security against chosen-ciphertext attacks given that the "encrypt" part is secure against chosen-plaintext attacks and the "MAC" part is secure against forgeries).