· updated · Permalink
So how on earth did the TPM end up with a strange love affair with AES-CFB+SHA-256 Encrypt-then-MAC? I mean, while it's a tad weird, it's not a horrible combo, but I'm still curious. Normally when I'm dealing with odd 2000s crypto it's like, AES-CBC.
Comments
The documentation I'm finding says because the TPM chips often just have hardware acceleration for the block cipher, and CFB doesn't need to expand payload size while CBC with an IV does. And then they throw a MAC on.