Practical uses of Manipulation Detection Code (MDC) and IGE

Question

I've just skimmed over most of the paper "On Message Integrity in Symmetric Encryption". I've included (the last) part of the abstract below:

We show that generic compositions of confidentiality-secure encryption schemes with Manipulation Detection Code (MDC) functions for authenticated encryption are, in general, weaker than "encrypt-than-authenticate" compositions using strong Message Authentication Code [edit: (MAC)] schemes. Since the former compositions lead, in general, to authenticated encryption schemes that are faster, more power-efficient, and simpler implementations than the latter, we conclude that both types of composition are necessary in practice for different application environments.

Now despite this claim I cannot find any protocols that e.g. use the Infinite Garble Extension (IGE) or double IGE (biIGE) modes of encryption.

Furthermore I found the following rather alarming notes (that are more alarming since the aforementioned paper seems to be of a later date than the attack described in the last link):

http://www.metzdowd.com/pipermail/cryptography/2006-September/011423.html

https://groups.google.com/forum/#!topic/sci.crypt/4bkzm_n7UGA

So my two related questions are:

1. Can there be any practical use of MDCs in general?
2. Can there be any practical use of IGE or biIGE mode encryption?

Answer 1

Don't believe every claim ever made in any paper ever written, particularly when the paper provides little or no justification for the claim; not everything you read reflects the cryptographic consensus. This is particularly true for a paper written in 2002, which is a time our understanding of authenticated encryption and security engineering was still in flux.

Today, the conventional wisdom is: just use authenticated encryption, such as GCM, EAX, etc. For most purposes, there's really no compelling reason to ever use a special MDC-based scheme.

Can there ever be any practical use to MDCs? I don't know; that's too broad a question to answer. I don't know if anyone can ever convincingly tell you "no, they will never ever be useful, I absolutely guarantee it". But in general, I don't see much use to MDC-based schemes. I find it hard to imagine practical situations where I'd want to use a special MDC-based scheme. Standard authenticated encryption schemes are good enough.

I don't recommend use of IGE nor biIGE modes: if you have to ask, you shouldn't be using them. (There may be some very special situations where one might use them -- see, e.g., this use of biIGE in Minx, a system for anonymous communication -- but those are the exception instead of the norm.) For almost all ordinary real-world situations that you're likely to encounter, an authenticated encryption scheme is going to be adequate. Researchers have invented tons of clever ideas ever invented, but that doesn't mean they're all useful; in practice, a handful of standard primitives will cover you for 99% of real-world situations.