I have two questions for Clarification for AE mode choice criteria
GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly sensitive (more than other AE modes ?) to IV uniqueness requirement and completely fails if such requirement is not respected'. I personnaly in regard with planned target domain of application consider this as a weakness . So such weakness should'not weight in the criteria for AE mode selection ? Remain GCM the one of most powerful AE mode despite this weakness ? isn't EAX or OCB if no more patented a more efficient & secure choice ?
- CCM : I understood via such mode review that it is based on MacThenEncrypt procedure (CBC-MAC then CTR ) . So why is such mode always presented as candidate AE mode if only Encrypt-Then-Mac procedure seems actually recommended by cryptography experts ?