Cryptography - proposed requirement about MAC verification failure

[randomstuff]

Proposed requirement by Bart Preneel:

6.5.6 Verify that if the MAC verification fails, the decryption operation is not started, and if that is not possible, no plaintext is released.

Might be difficult to verify / quite low-level.

Caveat: This is not compatible with MAC-then-encrypt as still used with some TLS 1.2 ciphersuites. (see #2498).

[jmanico]

If we do add this in I suggest we just add the Caveat to the end of the requirement.

[tghosth]

I leave this up to @danielcuthbert's judgement, I am not sure about this one.