News for hackers. Stuff that matters.
Re:New TLS Padding Oracles by weinzierl on Tuesday February 26, 2019 @02:57PM (#19257785)
> You're less likely to blow that up than GCM.

Do you have a pointer where I can read about traps of GCM?

Re:New TLS Padding Oracles by tptacek on Tuesday February 26, 2019 @03:15PM (#19257940)
I don't know the best summary, but the broad strokes are that nonce reuse both destroys confidentiality and allows recovery of authentication keys --- this is an extraordinarily common problem and one attackers can sometimes induce --- as does truncating the GCM MAC, and, if you don't have hardware support for GCM (ie, x64 CLMUL), the table-based version is timable.