Given a stream cipher such as ChaCha20 and a MAC such as Poly1305, how do we handle data that comes in chunks in the encrypt-then-MAC scheme ?
For example, the plaintext is 530 bytes long. We read the first 512 bytes into a buffer, process this chunk, but what happens then ?
Do we
1.
- write the ciphertext of the incoming chunk
- update and write the MAC of this ciphertext
or
2.
- while (incoming chunk == 512B)
- write the ciphertext of the incoming chunk
- update the MAC with this ciphertext
- write the ciphertext of the last chunk with length L (<512)
- update the mac with this ciphertext
- write out the MAC
What about decryption ?
The goal of EtM is to be able to check the MAC before decrypting, so I think 2 is the right way of doing it, except if we just need one MAC tag at the end of the file (like with GCM).