Subject: Re: [TLS] rfc7366: is encrypt-then-mac implemented?

From: Peter Gutmann <[email-masked]>
Date: Thu, 30 Oct 2014 10:44:19 +0000

Manuel Pégourié-Gonnard <[email-masked]> writes:

>Sure, I'd never think of doing that. But I can certainly tell my code to
>compute
>
>  MAC_k( seq_num + type + version + length + encrypted_stuff )
>
>with length != length_of(encrypted_stuff). After all, for the MAC function,
>what we call "length" is just two meaningless bytes.

Oh, so the issue isn't that you're MAC'ing extra stuff that isn't there, but
that you're using a length value that includes stuff that isn't MAC'd?  In
other words in the above 'length' isn't 'length of encrypted_stuff that
follows the length value' but 'length of encrypted_stuff that follows the
length value + length of MAC'?

Peter.

---

From: Manuel Pégourié-Gonnard <[email-masked]>
Date: Thu, 30 Oct 2014 12:41:53 +0100

> length value + length of MAC'?
Precisely. It looks like we're making progress in undertanding each other.

(As a side point (since I'm not arguing that what I'm doing is The Right Thing
do to, rather that it's unclear from the text of the RFC), both options look
completely equivalent to me from a security point of view, since one needs to
know the length of the MAC to check it, anyway.)

Manuel.