Cryptography - suggested modification of 6.5.4

[randomstuff]

Current:

6.5.4 [MODIFIED, MOVED FROM 6.2.7] Verify that encrypted data is authenticated via signatures, as well as through authenticated cipher modes or HMAC for protection against unauthorized modification.

Proposed by Bart Preneel:

6.5.4 Verify that authenticated encryption modes are always used, preferably by using an authenticated encryption mode such as mentioned under 6.5.2 or by combining an encryption method with a secure MAC algorithm such as AES-CMAC, HMAC-SHA-2, AES-GMAC, Poly1305-AES.

with comment:

Digital signatures are rarely combined with encryption. I would not use the term signatures for a MAC algorithm.

[randomstuff]

OK for me after some wording changes.

Some notes/comment on my own:

• Some of these schemes are currently not in the crypto appendix, should be add them?
• Should be add Chacha20-Poly1305 in the list in 6.5.4?
• Should we have this list here or simply point to the appendix.
• " combining an encryption method with a secure MAC algorithm such as AES-CMAC, HMAC-SHA-2, AES-GMAC, Poly1305-AES" is somewhat ambiguous because it appears that AES-CMAC and friends are MAC algorithms whereas they are actually a combination of an encryption scheme and a MAC algorithm.

[jmanico]

Bart is fixing something that is technically somewhat inaccurate in the current requirement. I suggest we fix this for 5.0.

[tghosth]

I leave this up to @danielcuthbert's judgement, I am not sure about this one.