On 16.06.2015 14:43, Aris Adamantiadis wrote:
Hi Gerhard,
This is not exactly true. CTR modes have the length field encrypted.
etm MAC modes and AES-GCM have the length field in cleartext.
CBC is dangerous because the length field is encrypted with CBC.
What's exactly the topic encrypting the length field with CBC?
Any documentation/papers on this to understand (except the source)?
aes128-ctr + hmac-sha256 doesn't have any known vulnerability and
encrypts the packet length, but uses the bad practice of e&m.
chacha20-poly1305 encrypts both payload and packet len + uses
authenticated encryption (best practice), even if the implementation
looks very similar to etm.
Why is E&M bad practice?
Thank you.
Ciao,
Gerhard
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
