Hacker News Reader

Bruce Schneier was wrong about MtE. This isn't so much a matter of opinion as it is (a) the currently prevailing theory in academic cryptography, at least when it comes to generic composition, and (b) the clear verdict of the last 10 years of crypto vulnerabilities.

Just writing this to be clear: it's not a debate. Ignore Schneier on this. In his defense: the most notable things he wrote about MtE were written before this was well-understood.

View on HN

Actually Rogaway's new AEZ proposal for CAESAR has a sort of MtE: http://web.cs.ucdavis.edu/~rogaway/aez/aez.pdf

The "MAC" here is just a block of zeros, and if decryption successfully reveals such a block of zeros, then it's deemed authentic.

This is a pretty specific quality to their construction though, and it doesn't really work elsewhere.

Yep. "Generic composition" (taking independently designed MACs and cipher modes and rolling your own AE) is my cop-out in case 'pbsd shows up to correct me.

Generally, though, and without intending snark:

If you're discussing MTE v ETM, and Bruce Schneier comes up, the answer is ETM.

Encrypt-Then-MAC just makes sense. If the first thing you do when you receive a blob of encrypted data is check that it's authentic (in constant-time!), the attack surface is greatly reduced.

Reply on news.ycombinator.com