Re:New TLS Padding Oracles
by blattimwind on Tuesday February 26, 2019 @02:22PM
(#19257456)
But when CBC is used correctly (with authentication), then one could just as well use CTR and get a nice performance improvement. The differences between these two (IV reuse, malleability) only become relevant when they're used incorrectly in the first place.
[ Parent
| on HN ]
I would probably generally use CTR? But you can chop this up in different ways; CTR is faster than CBC, and slightly less code to implement, but CBC (assuming EtM) fails less catastrophically than CTR if initialized improperly. CBC+HMAC-SHA2 is probably the safest thing you can implement from scratch.
People should just use Tink or Nacl though.