4 ms·
This implementation is broken. It concatenates a hash of the plaintext to a CTR-mode ciphertext. That's weakly authenticated and leaks information about the pla
by sweis 15y ago
This implementation is broken. It concatenates a hash of the plaintext to a CTR-mode ciphertext. That's weakly authenticated and leaks information about the plaintext.
It would be better to HMAC the ciphertext with a second key value.
- eran 15y agoFixed. Thank you for advice about HMAC, now I am use it.