4 ms·
> Use encrypt-then-HMAC. Seriously. Yes really. No other choice is defensible in this age. If you think “oh but GCM” look more closely into its design. What's
by dlitz 13y ago
> Use encrypt-then-HMAC. Seriously. Yes really. No other choice is defensible in this age. If you think “oh but GCM” look more closely into its design.
What's the problem with GCM?
- geofft 13y agoThere is no problem; it encrypts in counter mode and then adds a MAC. :-) It's just a specific MAC that has its security properties intended to work with the counter-mode encryption, and lets you use the same key, and basically gets the details right for you. But the motivation for it doing encrypt-then-authenticate instead of vice versa is presumably the same as with separate encryption and HMAC.
- dlitz 13y agoWell then what's the alleged problem?