4 ms·
Missing from this blog post, but made clear here (http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html http://blog.crypto
by femto113 14y ago
Missing from this blog post, but made clear here (http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html http://blog.cryptographyengineering.com/2012/05/how-to-choos...) is that you need to USE TWO DIFFERENT KEYS, one for the cipher, the other for the MAC. This makes it practically impossible to forge a valid message, since even if someone forged an apparently valid cipher section they'd be unable generate the corresponding MAC (unless they already had your keys, in which case you're already toast).
- marshray 14y agoUsing two different keys is considered good practice, but I don't think it helps as much as you seem to think it does.
- tptacek 14y agoNot to mention: if you're doing it right, you really don't have to think about whether you have two keys; you just naturally kind of do. It's the systems where you consciously have to handle two different keys that you have to worry about, because they're probably not keying themselves safely to begin with.