Skip to main content
Polish
Source Link
fgrieu
  • 145.6k
  • 12
  • 319
  • 611

From the standpoint of integrity and proof of origin, signature is a superset of MAC, with the tremendous operational benefit that no secret is required for verification (drawbacks include larger size, slower generation, and typically slower verification with the possible exception of RSA/Rabin signature). Thus the poly1305 MAC in theory is redundant. From the standpoint of down-to-earth IT security (not cryptography), it may still be useful by making it harder to exploit software bugs in the code for decryption and whatever manipulates the result of decryption until signature verification.

But from the standpoint of confidentiality, a huge mistake is made: signing then enciphering without enciphering the signature! A guess of the plaintext can be checked. For example, if the plaintext is the name of a classmate, andname from the public class roll is public, poof goes all confidentialitysecrecy!

From the standpoint of integrity, signature is a superset of MAC, with the tremendous operational benefit that no secret is required for verification (drawbacks include larger size, slower generation, and typically slower verification with the possible exception of RSA/Rabin signature). Thus the poly1305 MAC in theory is redundant. From the standpoint of down-to-earth IT security (not cryptography), it may still be useful by making it harder to exploit software bugs in the code for decryption and whatever manipulates the result of decryption until signature verification.

But from the standpoint of confidentiality, a huge mistake is made: signing then enciphering without enciphering the signature! A guess of the plaintext can be checked. For example, if the plaintext is the name of a classmate, and the class roll is public, poof goes all confidentiality!

From the standpoint of integrity and proof of origin, signature is a superset of MAC, with the tremendous operational benefit that no secret is required for verification (drawbacks include larger size, slower generation, and typically slower verification with the possible exception of RSA/Rabin signature). Thus the poly1305 MAC in theory is redundant. From the standpoint of down-to-earth IT security (not cryptography), it may still be useful by making it harder to exploit software bugs in the code for decryption and whatever manipulates the result of decryption until signature verification.

But from the standpoint of confidentiality, a huge mistake is made: signing then enciphering without enciphering the signature! A guess of the plaintext can be checked. For example, if the plaintext is a name from the public class roll, poof goes secrecy!

Source Link
fgrieu
  • 145.6k
  • 12
  • 319
  • 611

From the standpoint of integrity, signature is a superset of MAC, with the tremendous operational benefit that no secret is required for verification (drawbacks include larger size, slower generation, and typically slower verification with the possible exception of RSA/Rabin signature). Thus the poly1305 MAC in theory is redundant. From the standpoint of down-to-earth IT security (not cryptography), it may still be useful by making it harder to exploit software bugs in the code for decryption and whatever manipulates the result of decryption until signature verification.

But from the standpoint of confidentiality, a huge mistake is made: signing then enciphering without enciphering the signature! A guess of the plaintext can be checked. For example, if the plaintext is the name of a classmate, and the class roll is public, poof goes all confidentiality!