Hacker News Reader

I follow. But, if they'd encrypted every segment with AES-OCB or AES-GCM, rather than raw AES-CTR and then relying on the RSA signature of a header with hashes, this bug wouldn't have been possible, right?

(I get that there are multiple ways to break a bug. :)

View on HN

Of course, in a perfect world we would all be doing that. However, there is a tradeoff of boot-time/power consumption/hardware complexity (the hw AES engine only does CCM/CTR/CBC). Given their track record though, I wouldn't be surprised if things still broke if they used GCM. I think the main takeaway isn't that there's a couple of things they could have done differently to prevent this (which is always true in hindsight), but that certain major design decisions made such bugs inevitable.

Reply on news.ycombinator.com