Is OCB as secure as GCM or CCM ?
Since OCB design is quite different from GCM and CCM, I was wondering if the security properties of these latters are satisfied by OCB, as well.
$\begingroup$
$\endgroup$
1
-
3$\begingroup$ It is possible that OCB is more secure than GCM (under certain scenarios), but I have no evidence to back that up $\endgroup$– Richie FrameAug 26, 2014 at 6:13
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
1
If you look in the OCB submission for CAESAR, you will see that the designers state the security is similar to that of GCM. I would note, however, that GCM has been shown to posses weak key classes, see for example:
answered Sep 2, 2014 at 9:41
-
1$\begingroup$ These alleged ‘weak key classes’ don't contradict the security promise of AES-GCM—they are relevant only after the adversary learns something from the recipient by successfully forging a message, which is an event that happens with negligibly small probability. Normally in cryptography we assume any forgery is catastrophic for an application and work to ensure it never happens, rather than worry about recovering the cryptography from a forgery. See this answer for a discussion of the confusion that arose from this series of papers. $\endgroup$ May 18, 2019 at 19:41
$\begingroup$
$\endgroup$
I found following explanation in a book (Serious Cryptography)
OCB is a bit less fragile than GCM against repeated nonces. For example,
if a nonce is used twice, an attacker that sees the two ciphertexts will
notice that, say, the third plaintext block of the first message is identical
to the third plaintext block of the second message. With GCM, attackers
can find not only duplicates but also XOR differences between blocks at
the same position. The impact of repeated nonces is therefore worse with
GCM than it is with OCB.
As with GCM, repeated nonces can break the authenticity of OCB,
though less effectively. For example, an attacker could combine blocks
from two messages authenticated with OCB to create another encrypted
message with the same checksum and tag as one of the original two
messages, but the attacker would not be able to recover a secret key as
with GCM.
