Subject: Re: [saag] getting rid of fairly old stuff (was: Re: POODLE avant le chein)

From: Peter Gutmann <[email-masked]>
Date: Wed, 29 Oct 2014 17:56:23 +0000

Watson Ladd <[email-masked]> writes:

>But all of this applies only to TLS: OpenPGP and S/MIME never even tried to
>provide a composition of encrypt and MAC, and SSH also got it wrong.

Minor nit: S/MIME (or at least CMS) does do encrypt-then-MAC, see RFC 6476.
PGP uses its own oddball encrypt-the-hash mechanism (yuck), and SSH still
resolutely sticks to MAC-then-encrypt.  I tried to get it changed but got
brushed off, and after the battle over getting it fixed in TLS I just didn't
feel like having the same fight over SSH as well.

Peter.