News for hackers. Stuff that matters.
Re:S3QL: an S3 FS with encryption, de-dup, immutable trees a... by dlitz on Tuesday September 01, 2015 @01:45PM (#10154311)
No, MAC-then-encrypt is very, very hard to get right, because you have to avoid creating side-channels (including timing side-channels) between the decryption operation, the padding check (if you're using a block cipher mode that requires padding), and the MAC check.

More to the point, if you're fielding a new MAC-then-encrypt design, then I don't trust your crypto, because your crypto knowledge is over a decade old. Krawczyk's paper was published in 2001: https://eprint.iacr.org/2001/045

There are no comments on this comment yet.