<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
As a cryptographer and a mathematician, I find both GCM and OCB modes quite fine. In general, IMHO “counter based algorithms” (assuming you mean CTR mode) are the best performance-wise, and applicability-wise. Having formal mathematical proofs of correctness
doesn’t hurt either (or did you notice?).
<div class=""><br class="">
</div>
<div class="">I fail to see any similarities with RC4, and cannot guess what lessons you might be referring to. Although, if you found a weakness in GCM mode - by all means, please share it with the wider audience. Or is it that you find it more difficult to
code than ECB?</div>
<div class=""><br class="">
</div>
<div class="">Any cryptographic software is “fiddly” if you pay (or if you *don’t* pay!) enough attention.</div>
<div class=""><br class="">
</div>
<div class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">On May 17, 2018, at 14:16 , Robert J. Hansen <<a href="mailto:rjh@sixdemonbag.org" class="">rjh@sixdemonbag.org</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">
<blockquote type="cite" class="">And please don't mention GCM - counter based algorithms are way too<br class="">
brittle for solid cryptography. Remember the RC4 lessons.<br class="">
</blockquote>
<br class="">
To say nothing of the implementation difficulty. The more complex the algorithm, the less the chance it'll be implemented correctly. As someone who's implemented GCM a couple of times, it's not a simple mode. It's tremendously fiddly. Complicated code leads
to complicated failure modes and testing difficulties.</div>
</div>
</blockquote>
</div>
</div>
</body>
</html>