Subject: Re: [TLS] rfc7366: is encrypt-then-mac implemented?

From: Peter Gutmann <[email-masked]>
Date: Thu, 30 Oct 2014 13:06:47 +0000

Christian Kahlo <[email-masked]> writes:

>But as stated before I'll have a look in the final RFC and compare it to the
>currently deployed implementation.

See the more recent messages about this though, there are two possible
interpretations, both equally valid, so don't go changing things just yet :-).

Peter.

---

From: "Christian Kahlo" <[email-masked]>
Date: Thu, 30 Oct 2014 17:09:51 +0100

> interpretations, both equally valid, so don't go changing things just

Done so. After reading some dozen eMails and bug reports at different
sites (Google, Mozilla) I think I'm now up to date what the whole
discussion is about.

I understood "TLSCipherText.length" in the MAC-function as the length
of the encrypted and padded data because the MAC is calculated exactly
over this - not anything else. This seemed quite logical to me. But I
now realize that fragment.length != length of the final data block on
the wire. It's more a question of wording - and how it is interpreted.

BTW: @all, after seeing all this: it is far, far easier to talk
to Peter or me directly in case of doubts about EtM than to open
tickets on systems all over the world we aren't aware of. ;-)

So, eid.vx4.net will keep its implementation for all those who
want to check and discuss RFC7366.

Best regards,
Christian