Cryptography - suggested modification of 6.5.5

[randomstuff]

Currently we have:

6.5.5 [ADDED] Verify that any authenticated signatures are operating in encrypt-then-MAC or encrypt-then-hash modes as required.

Proposed by Bart Preneel:

6.5.5 [ADDED] Verify that any combination of an encryption algorithm and a MAC algorithm is operating in encrypt-then-MAC modes as required.

Comment:

Digital signatures are rarely combined with encryption. I would not use the term signatures for a MAC algorithm.

[randomstuff]

This would change the requirement completely.

Is there any need for the original requirement? Is this used in practice?

My problem with the proposed requirement is that TLS 1.2 uses MAC-then-encrypt for non AEAD (eg. TLS_AES_128_CCM_SHA256) (unless when using some TLS extension with does not appear to be used in practice). If we have this requirement, should some provision be made for legacy/compatibility (in particular with TLS 1.2)?

[jmanico]

Again, signatures being used incorrectly again. We really want to get our terminology right. I suggest we fix this for 5.0.

[randomstuff]

I just noticed the "authenticated signatures" wording, which is weird. I think we are talking both about authenticated encryption and signcryption here (?).