As defined in the specification of OCB, the tag depends only on the checksum (that is just the binary sum of plain blocs), so if we construct two messages that have the same sum (this is very easy to do), we can get two different ciphertexts that have exactly the same tag.

So we can easily mount a ciphertext integrity attack against OCB and the game of the semantic security can be win with a probability one (we can construct a new valid ciphertext using a previously obtained one).

What am I missing that OCB is still considered secure?


I finally found the problem: there is an error in the course about the OCB mode presented in Coursera Cryptography 1 (by Pr. Dan Boneh). When I consulted the official specification of the OCB mode (RFC 7253), I found that the value used for the tag construction is the number of blocks m and not 0 as presented in the course (see the figure below), otherwise the scheme becomes insecure (an integrity attack can easily be mounted against the semantic security game!).

enter image description here

  • 1
    $\begingroup$ You might want to share this flaw in the slides on the official forum for the course or if no such thin exists contact the lecturer to inform him about it. $\endgroup$
    – SEJPM
    Apr 5 '17 at 9:19
  • $\begingroup$ @SEJPM The last time I pointed out a flaw there I didn't get any response, but trying does not hurt I suppose. $\endgroup$
    – Maarten Bodewes
    Apr 16 '17 at 14:22
  • $\begingroup$ I have tried but unfortunately no response !! $\endgroup$ Apr 16 '17 at 22:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.