Hi Remko, thanks for taking a look.
Should AES-GCM be considered as an AEAD scheme instead of AES-CBC+HMAC? As far as I can tell, it is more convenient to use, and more efficient (but I'm no crypto expert, maybe there are other reasons against/for it).
We're using AES-CBC/HMAC in ODR, because it's what other double ratchets are using as well, most notably signal protocol. This means implementors can reuse that code without touching the crypto. We've decided to also use it for the payload encryption, because this way you won't need several different implementations for your crypto code. You can just use whatever ships with your double ratchet implementation. GCM also isn't quite as easily available on some platforms as we'd like, whereas CBC and HMAC are pretty much ubiquitous.
> Another question that pops up: the envelope now contains the > different message headers as XML attributes. However, these headers > need to be authenticated by the AEAD algorithm. So, the entire header > needs to be serialized so it can be passed to the AEAD algorithm, and > it's not defined how this has to be done. Yes, very good point. Thanks. I'll fix this. Cheers, Andy _______________________________________________ Standards mailing list Info: https://mail.jabber.org/mailman/listinfo/standards Unsubscribe: [email protected] _______________________________________________
