Questions tagged [ocb]

The Offset CodeBook Mode, an authenticated encryption mode of operation for a block cipher.

17
votes
1answer
603 views

What is the new attack on OCB2 and how does it work?

OCB2 is proposed by Rogaway, Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC , and it is standardized in ISO/IEC 19772:2009. The author also provided a proof ...
16
votes
4answers
6k views

Why is OCB-AES mode not becoming a standard for authenticated encryption?

The OCB mode of authenticated encryption (used for example with AES) is the fastest way to provide authenticity and confidentiality without having to strive into questions like: Encrypt then MAC, MAC ...
8
votes
1answer
114 views

Is the risk of a collision for OCB mode mitigated by upping the block size of the cipher?

A paper published by Niels Furguson Collision attacks on OCB indicates that processing large amounts of data (somewhere on the order of $2^{32}$ 128 bit blocks) with a single encryption operation (...
7
votes
1answer
356 views

OCB and GCM security

Is OCB as secure as GCM or CCM ? Since OCB design is quite different from GCM and CCM, I was wondering if the security properties of these latters are satisfied by OCB, as well.
3
votes
1answer
2k views

Proper uses for CTR and CBC AES block cipher modes

Assuming the following: Key is randomly generated is being used (32 bytes+) IV is also randomly generated Crypto random key generator is used Data being encrypted contains common bytes like ...
2
votes
2answers
379 views

OCB nonce usage

I've just come across this piece of code in Bouncy Castle's implementation of OCB Mode: ...
2
votes
0answers
368 views

AES OCB with Argon2 KDF for keyring file encryption

I've just released a python keyring companion package to encrypt the passwords in a file, available here. Description The project is mainly targeted to provide a sufficiently secure storage for ...
2
votes
0answers
261 views

Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
1
vote
1answer
219 views

Forgery attack on OCB

When using same nonce in OCB mode of authenticated encryption, how forgery attack can be done?
1
vote
1answer
131 views

Is OCB with short MAC malleable?

At the beginning of OCB's white paper [pdf], OCB is compared to other modes, and non-malleability is one of the properties advertised. At the end of the paper, it is mentioned the MAC length can be ...