Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The formalisms are important. I wish they weren't, and this stuff was all ready to go and easy to use correctly. But there's sadly no such commonly available system for that, everything has tradeoffs and many of them are subtle.

The SIV modes are great, they're much easier to use. When used in a full AHEAD construction (where you stick a random nonce in the AAD of a deterministic AEAD) you get nearly a "best of both worlds" non-deterministic encryption but without the catastrophic failure properties of something like GCM. But they're inherently 2-pass. So the user might have to deal with "chunking" their data, which can be annoying if they're streaming, etc. And since there are two passes over the plaintext with two different algorithms (one for the MAC to make the SIV, one to encrypt) that's two "traces" a side-channel observing attacker has which can make some attacks more powerful.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: