Subject: Re: Message Integrity

From: [email-masked]
Date: Wed, 21 Apr 1999 17:41:34 -0700

Just to clarify, I did not mean to suggest that the hash would be at the
beginning.  I agree that it is better to put it at the end, to facilitate
one pass operation.

What I meant to emphasize was that the hash would be encrypted, along with
the plaintext.  The input to the encryption would look like:

      checkbytes    plaintext    hash

This would all be encrypted to form the ciphertext.  The packet would then
look like:

      IV    ciphertext

Sorry if I was unclear.

Hal

---

From: [email-masked]
Date: Thu, 22 Apr 1999 09:31:33 -0700

Werner Koch, <[email-masked]>, writes:
> However, to come to a solution we should use the
>         IV|checkbytes|plaintext|SHA1
> proposal and assign a new packet type to it (and add a version number
> just in case we want to change it again).
>
> How do we handle secret key material encryption with 128 bit
> blocksizes?  Increase the IV in the packet to the blocksize or keep
> it at 8 bytes?

I think for consistency and simplicity we should have all IVs be the
cipher's blocksize.  In the old-style encryption packets this is a
necessity, as I pointed out earlier.  It also simplifies implementation
in that you can just point at the IV in the packet and load it into
the cipher.  With 8 byte IVs I had to move the 8 bytes into a buffer
and zero the other 8 bytes to have a nice 16-byte block of data that I
could pass to the encryption algorithm.

Hal