3 ms·
"And I still maintain that recommendation. CTR+HMAC is far more robust against side channel attacks than any AE mode." -- https://twitter.com/cperciva/status/4
by dchest 12y ago
"And I still maintain that recommendation. CTR+HMAC is far more robust against side channel attacks than any AE mode." -- https://twitter.com/cperciva/status/475360367191674881 https://twitter.com/cperciva/status/475360367191674881
- tptacek 12y agoI think Colin has a hard row to hoe with this argument, given how often HMAC implementations cough up timing vulnerabilities. Even if you're stuck with GCM, GCM has the advantage of having mercifully few implementations. Everyone writes their own HMAC verifiers (badly).
- deleted 12y ago[deleted]