Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This proposal prefers AES-GCM. Interestingly, Adam Langley (Chrome) is against AES-GCM. https://www.imperialviolet.org/2013/01/13/rwc03.html


I think Adam Langley doesn't like GCM because its normal software implementation requires secret-dependent table lookups for speed. It's thus thought to be easy to produce a naive GCM implementation that will suffer from side channel attacks. That concern is rapidly being mitigated by newer CPUs which can do the multiplications for GCM in hardware.

From a theoretical perspective, the polynomial MACs (like GHASH) are very well understood.

But, much more importantly, the TLS GCM construction is the only modern stream encryption standardized and widely available to TLS. The block constructions in TLS suffer from being created before Encrypt-then-MAC was proven secure; they do the operations the other way around, and thus require extremely fiddly code to quash side channels that have (unlike GCM) already been shown to admit plausible attacks.

The author of this proposal probably isn't so much making a statement about GCM so much as he is suggesting that we need to deprecate the 90's-crypto parts of TLS, which is something that is hard to argue with.


My understanding is that Adam Langley prefers AES-GCM to all the other mac-then-encrypt cipher suites in tls 1.2. He's working on AES-GCM support in NSS [1].

[1] https://news.ycombinator.com/item?id=5365601





Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: