18 ms·

Included in the box when you buy an AES are several different cipher modes, many of them are most useful for injecting slugs of metal into you own feet. The on

Included in the box when you buy an AES are several different cipher modes, many of them are most useful for injecting slugs of metal into you own feet. The one you should use, AES-GCM, wasn't even in the original box, but was MacGyvered later.

api 5y ago
I'm not convinced that people who aren't able to learn enough to use AES properly will fare that much better with ChaCha20, Poly1305, and asymmetric key agreement. ChaCha doesn't make the key agreement stuff easier and if they're going to blow their feet off it's probably going to be there. GCM wasn't "MacGyvered" any more than ChaChaPoly. ChaCha doesn't give you authentication by itself, and you need authentication. You could in theory do ChaCha/GMAC or AES-CTR/Poly1305 and be okay if you engineered it properly. I think NaCl already has AES-CTR/Poly1305 in it.
- tptacek 5y ago
  What does asymmetric key agreement have to do with using ChaCha? There are definitely ways in which GCM is more brittle than ChaCha; in particular, you can use random nonces with XChaCha, and you technically can't safely do that with GCM. But really, throw a dart, your outcome will be the same either way.
  - api 5y ago
    You mean this? https://crypto.stackexchange.com/questions/42982/safety-of-random-nonce-with-aes-gcm https://crypto.stackexchange.com/questions/42982/safety-of-r... I personally prefer the SIV modes, but using a sequential nonce within a session is pretty much always better due to birthday attack stuff. Cryptography does advance over time. When GCM was introduced it was when everyone realized that you must always have authentication and they wanted a faster auth mode than HMAC. Makes me wonder what new understandings might be coming down the road other than the obvious quantum computing factor. The most recent one I remember is the risk of combining compression with crypto if the attacker can influence anything in the compressed data.

api 5y ago

I'm not convinced that people who aren't able to learn enough to use AES properly will fare that much better with ChaCha20, Poly1305, and asymmetric key agreement. ChaCha doesn't make the key agreement stuff easier and if they're going to blow their feet off it's probably going to be there. GCM wasn't "MacGyvered" any more than ChaChaPoly. ChaCha doesn't give you authentication by itself, and you need authentication. You could in theory do ChaCha/GMAC or AES-CTR/Poly1305 and be okay if you engineered it properly. I think NaCl already has AES-CTR/Poly1305 in it.

tptacek 5y ago
What does asymmetric key agreement have to do with using ChaCha? There are definitely ways in which GCM is more brittle than ChaCha; in particular, you can use random nonces with XChaCha, and you technically can't safely do that with GCM. But really, throw a dart, your outcome will be the same either way.
- api 5y ago
  You mean this? https://crypto.stackexchange.com/questions/42982/safety-of-random-nonce-with-aes-gcm https://crypto.stackexchange.com/questions/42982/safety-of-r... I personally prefer the SIV modes, but using a sequential nonce within a session is pretty much always better due to birthday attack stuff. Cryptography does advance over time. When GCM was introduced it was when everyone realized that you must always have authentication and they wanted a faster auth mode than HMAC. Makes me wonder what new understandings might be coming down the road other than the obvious quantum computing factor. The most recent one I remember is the risk of combining compression with crypto if the attacker can influence anything in the compressed data.