# Tag Info

## Hot answers tagged ocb

11

Because OCB is patented. And there are other good solutions for authenticated encryption that aren't patented. This makes them more suitable, in most situations. I can recommend, e.g., EAX, GCM, or CWC. EAX and GCM have been used in some standards, and AES-GCM has been standardized. For pointers where you can learn more, read Wikipedia. And try using ...

5

As D.W. mentioned, the patent on OCB really is a killer; who would want to go through the legal hassle and expense of licensing OCB, when there are free authenticated encrypted modes available. Another, considerably more minor issue, is that OCB does not support 'Additional Authenticated Data'. This is data that both the encryptor and decryptor provide to ...

3

You looked on version 1.49 where OCB was not fully implemented as it seems. Actually OCB uses only 120 bit nonce, the other 8 bits are encoded as described in the RFC. Have a look at version 1.50. There OCB seems (nearly) fully implemented and an exception is raised, if the given nonce is longer than 15 bytes (source code line #158).

2

The answer to your question is contained in the Authenticity bound (Theorem 5.1). This is because Authenticity implies non-malleability (see e.g. http://eprint.iacr.org/2011/092.pdf). Note that only one term in the bound refers to the length of the tag (referred to by the variable $\tau$): \mathbf{Adv}_{OCB}^{auth}[\mathrm{Perm}(n), \tau] (A) \leq ...

2

As said by Thomas in the comment, modern encryption algorithms should work for all kinds of data, regardless of whether the plaintext is partially known or not. In both modes of operation (CTR and CBC), for stored data you should remember to get a new initialization vector and reencrypt your whole "message" (or database entry) when changing any part of the ...

2

These are the shortcomings of OCB when one puts AES as the underlying block cipher- discussed in this presentation by Bernstein, Lange. First there's suboptimal performance of AES-OCB3 (earlier authenticated ciphers such as Phelix (although broken in the nonce-reuse scenario) already beat AES-OCB3). Next AES-OCB3 is provably secure given that AES secure, ...

2

I'll give another answer in case you or someone else needs to work with that version of OCB and/or Bouncy Castle. My understanding of this check is that if the nonce is longer than 16 bytes, or the nonce is 16 bytes and the first bit of the first byte of the nonce is not 0 (assuming big endian), then an error is thrown. Do I understand this ...

Only top voted, non community-wiki answers of a minimum length are eligible