OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem to be that it requires frequent rekeying ( every $~2^{13}$ blocks if one wants to match GCM auth robustness when very large amounts of data are transmitted) and is patented (a dealbreaker for many applications).

Are there any other modes that can match OCB for speed?

  • 2
    $\begingroup$ A recent paper generated such authenticated modes automatically. But those that matched OCB's features were trivially equivalent to OCB. Automated Analysis and Synthesis of Authenticated Encryption Schemes - Viet Tung Hoang and Jonathan Katz and Alex J. Malozemoff $\endgroup$ – CodesInChaos Apr 13 '16 at 12:30
  • $\begingroup$ To improve the security of OCB you could use a naturally tweakable block-cipher and/or wider blocks. Threefish would be an obvious choice. But of course it can't take advantage of AES-NI. $\endgroup$ – CodesInChaos Apr 13 '16 at 12:35
  • $\begingroup$ I have a mode that can match or beat OCB in some cases (32-bit code), but it has no security proof, and requires direct access to the AES round function, which means it cannot be used as a typical wrapper mode $\endgroup$ – Richie Frame Apr 13 '16 at 20:28
  • $\begingroup$ @RichieFrame what is it? $\endgroup$ – Demi Apr 13 '16 at 23:30
  • $\begingroup$ @Demetri It generates "offsets" similar to OBC, but uses the AES round function with special subkeys generated by the nonce and master key. There are other differences to OCB, but reuse of AES_NI is the main performance advantage, as offset generation is very slow on 32-bit platforms $\endgroup$ – Richie Frame Apr 14 '16 at 0:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.