Re: applying AES-GCM to secure shell: proposed "tweak"

[Nicolas Williams <Nicolas.Williams%sun.com@localhost>]

On Wed, Apr 15, 2009 at 06:10:50AM -0400, der Mouse wrote:
> >    Maybe it's easier to say that if an AEAD-algorithm is chosen for
> >    encryption, the lists of mac algorithms (for that direction) are
> >    ignored).
> 
> That would be a rather unpleasant violation of the existing definition.
> I'd much rather just re-kex if using a none MAC is that important.

AEAD cipher modes clearly combine the MAC into the cipher.  That
means that the MAC can no longer be negotiated separately from the
cipher.

Therefore I believe Niels is correct: when an AEAD cipher is selected
then the MAC negotiation MUST be ignored.