Subject: Re: [TLS] TLS1.3

From: Peter Gutmann <[email-masked]>
Date: Fri, 8 Feb 2013 10:50:12 +0000

"Lewis, Nick" <[email-masked]> writes:

>My understanding is that the current attack is due to the MAC revealing the
>length of the plaintext. If the plaintext is pre-padded to a full crypt block
>then a MAC can reveal no more than does the ciphertext itself

>From a very quick read of the paper in an airport lounge (i.e. not a very
detailed one) it looked like the crucial factor was whether you cross a 64-
byte HMAC block or not.  The padding size is dependent on low-level internals
of the MAC algorithm that's used.  In addition while it will stop the current
attack (which, in the case of straight TLS, isn't terribly practical anyway),
it won't stop other attacks.  Using encrypt-then-MAC OTOH stops a whole range
of attacks, including a number of ones that haven't been dreamed up yet,
because the encryption is no longer a possible target.

Peter.