Is OCB as secure as GCM or CCM ?
Since OCB design is quite different from GCM and CCM, I was wondering if the security properties of these latters are satisfied by OCB, as well.
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this communityIs OCB as secure as GCM or CCM ?
Since OCB design is quite different from GCM and CCM, I was wondering if the security properties of these latters are satisfied by OCB, as well.
If you look in the OCB submission for CAESAR, you will see that the designers state the security is similar to that of GCM. I would note, however, that GCM has been shown to posses weak key classes, see for example:
I found following explanation in a book (Serious Cryptography)
OCB is a bit less fragile than GCM against repeated nonces. For example,
if a nonce is used twice, an attacker that sees the two ciphertexts will
notice that, say, the third plaintext block of the first message is identical
to the third plaintext block of the second message. With GCM, attackers
can find not only duplicates but also XOR differences between blocks at
the same position. The impact of repeated nonces is therefore worse with
GCM than it is with OCB.
As with GCM, repeated nonces can break the authenticity of OCB,
though less effectively. For example, an attacker could combine blocks
from two messages authenticated with OCB to create another encrypted
message with the same checksum and tag as one of the original two
messages, but the attacker would not be able to recover a secret key as
with GCM.