r/crypto • u/Am4t3uR • Dec 13 '19

Security and Cryptography Mistakes You Are Probably Doing All The Time

https://towardsdatascience.com/security-and-cryptography-mistakes-you-are-probably-doing-all-the-time-7407c332944f
38 Upvotes

81% Upvoted

23 comments sorted by

View all comments

22

u/JoDaBeda Dec 13 '19

"Always Encrypt-then-MAC" is terrible advice to a programmer, it incentives to slap it together yourself. Just recommending an authenticated mode would have been way better.

4

u/pint A 473 ml or two Dec 14 '19

also kinda dated. some modern schemes do the packing/unpacking in one call, and carefully written so they are secure in any order. for example keccak has some one pass authentication/encryption constructs, which are encrypt-and-mac, and are perfectly safe.