Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

In many cases where you use an HMAC, you'll also want to encrypt as well (ie: web cookies, tokens, etc). Because of this, I find it's much better just to go with AES-GCM from the start rather than discovering that you don't want to leak your internal DB identifiers later and tacking on the encrypt-then-mac.

It also means that the implementation of the algorithm does the work of both authentication and privacy, whereas with HMAC-SHA256 (and HMAC-SHA256 + AES-CBC/CTR) you will see developers hand-rolling more of it, leaving more room for them to do it wrong.

I also prefer that AES-GCM is a mode itself, while encrypt-then-mac generally requires a developer to do research into the appropriate encryption mode and other details required to "get this right".



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: