2
$\begingroup$

This is a hypothetical question. Is it possible to use a stream cipher instead of a block cipher for an OCB type single pass AEAD?

The xor of the plaintext blocks for the authentication tag can't work because a change in the ciphertext doesn't change the plaintext enough so maybe the answer is no.

$\endgroup$

1 Answer 1

1
$\begingroup$

Well, this is hard to answer; a straight-forward insertion of a stream cipher replacing AES doesn't work; however how large of a change can we envision between the resulting modified cipher is no longer "OCB-like"?

a change in the ciphertext doesn't change the plaintext enough so maybe the answer is no

This issue isn't that the size of the change, but the result of the change is predictable (and so the attacker can modify the tag to account for it). In addition, if the attacker makes the same change to two different blocks, the result is no change to the xor, and so it doesn't work to do something secret to the tag after all the plaintext blocks have been xor'ed together.

One obvious approach is not to do a straight-forward xor of the plaintext blocks, but instead something a bit more unpredictable, such as (say) an iterated secret linear operation. However, that starts to make the system look more like GCM (if we restrict the secret linear operation to GF multiplication by a secret element [1]); I don't know if that would be considered 'OCB-like'...

[1]: Yes, I'm aware that GCM processes the ciphertext blocks, not the plaintext blocks...

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.