Re:All the crypto code you've ever written is probably broken
by tptacek on Tuesday November 13, 2012 @01:42PM
(#4779728)
Among other things, because the system you just described is vulnerable to chosen ciphertext attacks.
[ Parent
| on HN ]
Re:All the crypto code you've ever written is probably broken
by Imbue on Tuesday November 13, 2012 @04:36PM
(#4780776)
But if someone chooses a ciphertext (without knowing the key), how could they get the checksum right (which is also encrypted)? If the checksum was wrong, the system would refuse to decrypt the corrupted message.
Re:All the crypto code you've ever written is probably broken
by tptacek on Tuesday November 13, 2012 @04:42PM
(#4780794)
No. There's no such thing as "refusing to decrypt a corrupted message"; cipher cores either produce an expected plaintext or, if the message is corrupted, an unexpected plaintext. Attackers can use changes in behavior based on the differences between different unexpected resulting plaintexts to infer the original plaintext.
Re:All the crypto code you've ever written is probably broken
by Imbue on Tuesday November 13, 2012 @07:42PM
(#4781444)
My question was why is a proper MAC better than appending a checksum to the plain text and then encrypting. With an appended and encrypted checksum, the system could easily reject corrupted messages, that's the whole point of a checksum in the first place.
So why is a proper MAC better than appending a checksum or hash to the plaintext and then encrypting? Or maybe I am misunderstanding something?
Re:All the crypto code you've ever written is probably broken
by tptacek on Tuesday November 13, 2012 @08:03PM
(#4781493)
I've answered that already. The MAC allows the cryptosystem to reject messages with corrupted ciphertexts. If you don't do that, it can be possible to use controlled corrupted ciphertexts to learn things about the plaintexts of messages, and not just via CBC padding oracles.
Re:All the crypto code you've ever written is probably broken
by serge2k on Tuesday November 13, 2012 @05:28PM
(#4781009)
Doesn't encrypt then mac allow you to reject messages prior to decryption?
Re:All the crypto code you've ever written is probably broken
by tptacek on Tuesday November 13, 2012 @06:07PM
(#4781153)
Yes. That's not what we're talking about here, though.
Re:All the crypto code you've ever written is probably broken
by cloudsteam on Wednesday November 14, 2012 @07:14AM
(#4783034)
how would the plain texts differ?