# In what paper was OCB2 introduced?

I've been working through "Cryptanalysis of OCB2: Attacks on Authenticity and Confidentiality" 1 from earlier this year. My knowledge of OCB2 is pretty shallow though, and so I'm keen to study the scheme in depth before I continue.

From citations and searching around, it seems like OCB2 was introduced in a 2004 paper by Rogaway titled "Efficient instantiations of tweakable blockciphers and refinements to modes OCB and PMAC" 2.

There aren't any explicit mentions of OCB2 in this paper though. Section 10 is titled "The OCB1 Authenticated-Encryption Scheme" and includes a description of "OCB1 with an ideal tweakable blockcipher". The scheme described in that section matches what I have read about OCB2.

I suppose the scheme only started being called OCB2 after the publication of the paper? Is that correct? If not, where can I find a description of OCB2?

• listed here What is the new attack on OCB2 and how does it work? the name comes with the standard? – kelalaka Oct 26 '20 at 9:43
• Wikipedia states as OCB2 was first published in 2003, originally named authenticated-encryption mode, or advanced encryption mode (AEM) – kelalaka Oct 26 '20 at 10:07
• Thanks for your help kelalaka. Are you saying the answer to my question is "yes"? – djwj Oct 26 '20 at 10:26
• Thanks. I'll try get access to that standard and if I can, I'll write an answer up. Because I think there is value in making this link explicitly and in a way that can be found from a web search. I was personally pretty confused when I first read that paper and spent a bunch of time searching the internet under the assumption that I had downloaded the wrong PDF. – djwj Oct 26 '20 at 10:38