Suppose that I have a chunked stream. Each chunk is to be encrypted separately. The structure is basically this:
How should one handle the LEN field? If I encrypt the whole thing in a
(), this encrypts the LEN field as well. So at decrypt, LEN field must be first decrypted, to find out, where the MAC is. Which is considered a bad thing (as I found at several places that the recommendation is: "one should verify MAC before decryption").
The other solution, to pass LEN in cleartext, maybe not a good idea either, as I'd like to encrypt everything.
What's the correct solution for this problem?