Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

At the beginning of OCB's white paper [pdf], OCB is compared to other modes, and non-malleability is one of the properties advertised.

At the end of the paper, it is mentioned the MAC length can be chosen by users according to their needs.

Was long MACs assumed in the claim of non-malleability, or is the property still holding with short/no MACs ?

share|improve this question

The answer to your question is contained in the Authenticity bound (Theorem 5.1). This is because Authenticity implies non-malleability (see e.g. Note that only one term in the bound refers to the length of the tag (referred to by the variable $\tau$):

$$\mathbf{Adv}_{OCB}^{auth}[\mathrm{Perm}(n), \tau] (A) \leq \dfrac{1.5\overline{\sigma}^2}{2^n}+\dfrac{1}{2^{\tau}},$$

where $\overline{\sigma} = \sigma + 2q + 5c + 11$, such that $q$ is the number of chosen plaintext queries of aggregate length $\sigma$ blocks, and $c$ is the total length in blocks of the attempted forgery.

As you can see, the length of the tag only matters for the last term. So if the tag is 128 bits then the last term adds $\frac{1}{2^{128}}$ to the total Adversarial advantage. But if the tag is truncated to only 32 bits then the advantage will increase by $\frac{1}{2^{32}}$, which is about 1 in 4 billion. Depending on your risk tolerance and threat model, the latter increase in Adversarial advantage might be acceptably small in exchange for the space savings of shorter tags.

share|improve this answer
Of course, that inequality is trivial when $\: \tau = 0 \:$ (i.e., there is no MAC). $\;\;\;$ – Ricky Demer Jan 12 '14 at 23:07
Indeed. As Ricky points out, $1/2^0 = 1/1 = 1$, and 1 is the maximum possible Advantage. So the upper bound on Adversarial advantage described in Theorem 5.1 doesn't really do any 'bounding' when there is no tag at all. – J.D. Jan 12 '14 at 23:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.