Subject: [TLS] On the efficency of ETA.

From: Watson Ladd <[email-masked]>
Date: Wed, 4 Dec 2013 10:43:05 -0800

CBC is IV based, not nonce based. Turning it into a nonce - based scheme
requires an additional cipher call, and a reexamination of the security
proof. (Naive use of the Bernstein interpolation lemma leads to quartic
loss as we already have quadratic loss in CBC)

That leaves us with the IV based constructions which all require three
invocations of the MAC. Let's just stick with counter mode+nonce based MAC:
the efficient, obviously secure choice.
Sincerely,
Watson Ladd