Tag Info

Hot answers tagged

10

Because OCB is patented. And there are other good solutions for authenticated encryption that aren't patented. This makes them more suitable, in most situations. I can recommend, e.g., EAX, GCM, or CWC. EAX and GCM have been used in some standards, and AES-GCM has been standardized. For pointers where you can learn more, read Wikipedia. And try using ...


4

As D.W. mentioned, the patent on OCB really is a killer; who would want to go through the legal hassle and expense of licensing OCB, when there are free authenticated encrypted modes available. Another, considerably more minor issue, is that OCB does not support 'Additional Authenticated Data'. This is data that both the encryptor and decryptor provide to ...


2

The answer to your question is contained in the Authenticity bound (Theorem 5.1). This is because Authenticity implies non-malleability (see e.g. http://eprint.iacr.org/2011/092.pdf). Note that only one term in the bound refers to the length of the tag (referred to by the variable $\tau$): $$\mathbf{Adv}_{OCB}^{auth}[\mathrm{Perm}(n), \tau] (A) \leq ...


2

As said by Thomas in the comment, modern encryption algorithms should work for all kinds of data, regardless of whether the plaintext is partially known or not. In both modes of operation (CTR and CBC), for stored data you should remember to get a new initialization vector and reencrypt your whole "message" (or database entry) when changing any part of the ...


1

These are the shortcomings of OCB when one puts AES as the underlying block cipher- discussed in this presentation by Bernstein, Lange. First there's suboptimal performance of AES-OCB3 (earlier authenticated ciphers such as Phelix (although broken in the nonce-reuse scenario) already beat AES-OCB3). Next AES-OCB3 is provably secure given that AES secure, ...



Only top voted, non community-wiki answers of a minimum length are eligible