2
$\begingroup$

I've been working through "Cryptanalysis of OCB2: Attacks on Authenticity and Confidentiality" 1 from earlier this year. My knowledge of OCB2 is pretty shallow though, and so I'm keen to study the scheme in depth before I continue.

From citations and searching around, it seems like OCB2 was introduced in a 2004 paper by Rogaway titled "Efficient instantiations of tweakable blockciphers and refinements to modes OCB and PMAC" 2.

There aren't any explicit mentions of OCB2 in this paper though. Section 10 is titled "The OCB1 Authenticated-Encryption Scheme" and includes a description of "OCB1 with an ideal tweakable blockcipher". The scheme described in that section matches what I have read about OCB2.

I suppose the scheme only started being called OCB2 after the publication of the paper? Is that correct? If not, where can I find a description of OCB2?

Improve this question
$\endgroup$
7
  • $\begingroup$ listed here What is the new attack on OCB2 and how does it work? the name comes with the standard? $\endgroup$
    – kelalaka
    Commented Oct 26, 2020 at 9:43
  • $\begingroup$ I had read that thread before asking this question, but don't have access to the standard. $\endgroup$
    – djwj
    Commented Oct 26, 2020 at 9:56
  • $\begingroup$ Wikipedia states as OCB2 was first published in 2003, originally named authenticated-encryption mode, or advanced encryption mode (AEM) $\endgroup$
    – kelalaka
    Commented Oct 26, 2020 at 10:07
  • $\begingroup$ Thanks for your help kelalaka. Are you saying the answer to my question is "yes"? $\endgroup$
    – djwj
    Commented Oct 26, 2020 at 10:26
  • 1
    $\begingroup$ Thanks. I'll try get access to that standard and if I can, I'll write an answer up. Because I think there is value in making this link explicitly and in a way that can be found from a web search. I was personally pretty confused when I first read that paper and spent a bunch of time searching the internet under the assumption that I had downloaded the wrong PDF. $\endgroup$
    – djwj
    Commented Oct 26, 2020 at 10:38

1 Answer 1

Reset to default
2
$\begingroup$

You are correct: OCB2 was only named so after the fact. Confusingly, it was named OCB1 in the original 2004 paper.

You can find the OCB2 naming on the paper that introduces OCB3, The Software Performance of Authenticated-Encryption Modes:

Integrated AE schemes were invented to improve performance of composed ones, but it has not been clear if they do. In the only comparative study to date [31], McGrew and Viega found that their composed scheme, GCM, was about as fast as, and sometimes faster than, the integrated scheme OCB [35] (hereinafter OCB1, to distinguish it from a subsequent variant we’ll call OCB2 [34]).

Another instance of the name transitioning is in two papers of Minematsu. The first one, Improved Security Analysis of XEX and LRW Modes at SAC 2006, refers to the mode as the original OCB1; a later paper written in 2008, Generalization and Extension of XEX* Mode, already refers to it as OCB 2.0.

Finally, a patent filed by Rogaway in 2005 refers to the mode as OCB 2.0, which is presumably where the name change happened first.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.