4 ms·

Yep. I know you know better, but since it's essentially the same carelessness I first complained about I figured I should be consistent and complain again! One

Yep. I know you know better, but since it's essentially the same carelessness I first complained about I figured I should be consistent and complain again! One of the nice things about Blake3 is that it does have a KDF mode built in. And a MAC mode. And there's a (stalled) proposal to build in an AHEAD mode, though IMO it needs more academic security analysis (IIRC that's part of why it stalled). It might not be as interestingly innovative as the sponge construction Keccak introduced, but it's a very versatile primitive with excellent software performance.

tptacek 5y ago
No, you're 100% right to call it out! I went into this thinking that much of this discussion was pedantic and missed the point that a generic composition of a good stream cipher and a hash MAC has benefits --- and leave it mostly agreeing that the formalisms that people seemed hung up on are indeed pretty important.
- SAI_Peregrinus 5y ago
  The formalisms are important. I wish they weren't, and this stuff was all ready to go and easy to use correctly. But there's sadly no such commonly available system for that, everything has tradeoffs and many of them are subtle. The SIV modes are great, they're much easier to use. When used in a full AHEAD construction (where you stick a random nonce in the AAD of a deterministic AEAD) you get nearly a "best of both worlds" non-deterministic encryption but without the catastrophic failure properties of something like GCM. But they're inherently 2-pass. So the user might have to deal with "chunking" their data, which can be annoying if they're streaming, etc. And since there are two passes over the plaintext with two different algorithms (one for the MAC to make the SIV, one to encrypt) that's two "traces" a side-channel observing attacker has which can make some attacks more powerful.

tptacek 5y ago

No, you're 100% right to call it out! I went into this thinking that much of this discussion was pedantic and missed the point that a generic composition of a good stream cipher and a hash MAC has benefits --- and leave it mostly agreeing that the formalisms that people seemed hung up on are indeed pretty important.

SAI_Peregrinus 5y ago
The formalisms are important. I wish they weren't, and this stuff was all ready to go and easy to use correctly. But there's sadly no such commonly available system for that, everything has tradeoffs and many of them are subtle. The SIV modes are great, they're much easier to use. When used in a full AHEAD construction (where you stick a random nonce in the AAD of a deterministic AEAD) you get nearly a "best of both worlds" non-deterministic encryption but without the catastrophic failure properties of something like GCM. But they're inherently 2-pass. So the user might have to deal with "chunking" their data, which can be annoying if they're streaming, etc. And since there are two passes over the plaintext with two different algorithms (one for the MAC to make the SIV, one to encrypt) that's two "traces" a side-channel observing attacker has which can make some attacks more powerful.