Hacker News new | past | comments | ask | show | jobs | submit login

If you use randomness (like in say CBC mode) that should suffice to give you IND-CPA security, no? And I believe GCM mode gives you IND-CCA2 security as well.



Actually CBC is a great mode for demonstrating how constructions built on secure primitives can introduce vulnerabilities. We can prepend a specific block to one with known plaintext in CBC mode to end up with garbage + plaintext we control.


There is a reason HTTP/2 requires GCM or other AEAD. TLS's MAC-before-encrypt is flawed because of these kinds of attacks.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: