Is OCB as secure as GCM or CCM ?

Since OCB design is quite different from GCM and CCM, I was wondering if the security properties of these latters are satisfied by OCB, as well.

  • 2
    $\begingroup$ It is possible that OCB is more secure than GCM (under certain scenarios), but I have no evidence to back that up $\endgroup$ – Richie Frame Aug 26 '14 at 6:13

If you look in the OCB submission for CAESAR, you will see that the designers state the security is similar to that of GCM. I would note, however, that GCM has been shown to posses weak key classes, see for example:

  • $\begingroup$ These alleged ‘weak key classes’ don't contradict the security promise of AES-GCM—they are relevant only after the adversary learns something from the recipient by successfully forging a message, which is an event that happens with negligibly small probability. Normally in cryptography we assume any forgery is catastrophic for an application and work to ensure it never happens, rather than worry about recovering the cryptography from a forgery. See this answer for a discussion of the confusion that arose from this series of papers. $\endgroup$ – Squeamish Ossifrage May 18 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.