Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I think Thomas Pornin's [reply](http://security.stackexchange.com/questions/20464/when-authe...) (and our subsequent back-and-forth) to a question of mine on the security StackExchange highlights exactly how hard it is to Encrypt-Then-MAC yourself properly.

You should use a separate key for the encrypt phase and MAC phase. You must MAC the ciphertext, the IV, the authenticated data, and possibly a specifier for the encryption algorithm. You must also construct the MAC'd string in a way that prevents tampering with field boundaries.



Just to be clear, these are all details GCM takes care of.


Yes, absolutely. Use GCM (or XSalsa20Poly1305) whenever possible.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: