Subject: [Cfrg] OCB Mode Internet-Draft Available

From: Ted Krovetz <[email-masked]>
Date: Fri, 25 Mar 2005 09:48:25 -0800

Hello,

OCB, an authenticated-encryption mode of operation from Rogaway, 
Bellare and Black has been revised and defined in an Internet-Draft. 
The new version is being called OCB 2.0.

   http://www.ietf.org/internet-drafts/draft-krovetz-ocb-00.txt

Any comments on the draft, including verification of the test vectors, 
would be appreciated.

There were no security reasons for the revision. The newer version is 
more efficient and versatile.

* OCB 1.0 could not directly handle associated-data; OCB 2.0 has this 
capability. Associated-data refers to an unencrypted header that should 
be authenticated but not encrypted when one encrypts a message. Only 
after releasing OCB 1.0 was it realized that it was important to 
directly build in this capability.

* The second reason for the update is that a cleaner way was found to 
create the sequence of internal offsets that are needed. The new method 
is simple and constant-time. The old method, which depended on Gray 
codes and the number of trailing zero bits in the representation of 
successive integers, was more complex to understand and to implement.

OCB 2.0 was first specified in late 2003. It was named AEM 
(authenticated-encryption mode, or advanced encryption mode) for a 
short while. It was later renamed OCB 2.0 to make its lineage more 
clear: the differences between OCB 1.0 and OCB 2.0 are small.

There is a FAQ on OCB, as well as other goodies, at

   http://www.cs.ucdavis.edu/~rogaway/ocb/

Thank you,
Ted Krovetz
Computer Science Department
California State University, Sacramento

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: Russ Housley <[email-masked]>
Date: Fri, 25 Mar 2005 14:36:53 -0500

Ted:

For this to proceed to publication as an RFC, an IPR statement must be 
submitted to the IETF Secretariat.  I think the statement should come from 
Phil.  See https://datatracker.ietf.org/public/ipr_disclosure.cgi

Russ

At 12:48 PM 3/25/2005, Ted Krovetz wrote:
>Hello,
>
>OCB, an authenticated-encryption mode of operation from Rogaway, Bellare 
>and Black has been revised and defined in an Internet-Draft. The new 
>version is being called OCB 2.0.
>
>There were no security reasons for the revision. The newer version is more 
>efficient and versatile.
>
>capability. Associated-data refers to an unencrypted header that should be 
>authenticated but not encrypted when one encrypts a message. Only after 
>releasing OCB 1.0 was it realized that it was important to directly build 
>in this capability.
>
>create the sequence of internal offsets that are needed. The new method is 
>simple and constant-time. The old method, which depended on Gray codes and 
>the number of trailing zero bits in the representation of successive 
>integers, was more complex to understand and to implement.
>
>(authenticated-encryption mode, or advanced encryption mode) for a short 
>while. It was later renamed OCB 2.0 to make its lineage more clear: the 
>differences between OCB 1.0 and OCB 2.0 are small.
>

---

From: "D. J. Bernstein" <[email-masked]>
Date: 26 Mar 2005 00:15:54 -0000

The draft says that OCB is the most efficient solution available, but
doesn't give any comparative timings to back this up! I'm particularly
concerned about

   (1) the overhead for the ``fixed number of logical operations,''
   (2) the overhead for small packets,
   (3) the overhead for expanding or loading decryption keys, and
   (4) the cost of rejecting forgeries---does this require decryption?

There's nothing wrong with a document that defines the function without
commenting on speed, but a document that makes a bold claim about ``the
most efficient way known'' has to go into considerably more detail.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

---

From: [email-masked] (Peter Gutmann)
Date: Sat, 26 Mar 2005 16:35:36 +1200

>The new version is being called OCB 2.0.

This algorithm, *and* the ginsu knives, can be yours for a mere $100-200K
in licensing fees!

(Please, no patent flamewars, just pointing out that against unrestricted
 modes like CCM and GCM it doesn't stand much chance).

Peter.