4 ms·
Actually Rogaway's new AEZ proposal for CAESAR has a sort of MtE: http://web.cs.ucdavis.edu/~rogaway/aez/aez.pdf http://web.cs.ucdavis.edu/~rogaway/aez/aez.pdf
by zx2c4 11y ago
Actually Rogaway's new AEZ proposal for CAESAR has a sort of MtE: http://web.cs.ucdavis.edu/~rogaway/aez/aez.pdf http://web.cs.ucdavis.edu/~rogaway/aez/aez.pdf
The "MAC" here is just a block of zeros, and if decryption successfully reveals such a block of zeros, then it's deemed authentic.
This is a pretty specific quality to their construction though, and it doesn't really work elsewhere.
- tptacek 11y agoYep. "Generic composition" (taking independently designed MACs and cipher modes and rolling your own AE) is my cop-out in case 'pbsd shows up to correct me. Generally, though, and without intending snark: If you're discussing MTE v ETM, and Bruce Schneier comes up, the answer is ETM.