OCB mode
Offset codebook mode(OCB mode) is anauthenticated encryptionmode of operationfor cryptographicblock ciphers.[1][2]OCB mode was designed byPhillip Rogaway,who creditsMihir Bellare,John Black,and Ted Krovetz with assistance and comments on the designs. It is based on theintegrity-aware parallelizeable mode(IAPM) of authenticated encryption by Charanjit S. Jutla. TheOCB2version was proven insecure, while the originalOCB1as well asOCB3from 2011 are still considered secure.
Encryption and authentication
[edit]OCB mode was designed to provide bothmessage authenticationandprivacy.It is essentially a scheme for integrating amessage authentication code(MAC) into the operation of ablock cipher.In this way, OCB mode avoids the need to use two systems: a MAC for authentication andencryptionfor confidentiality. This results in lower computational cost compared to using separate encryption and authentication functions.
There are three versions of OCB: OCB1, OCB2 and OCB3. OCB1 was published in 2001. OCB2 improves on OCB1 by allowing associated data to be included with the message, providingauthenticated encryption with associated data(AEAD; that is, data that are not encrypted but should be authenticated) and a new method for generating a sequence of offsets. OCB2 was first published in 2003, originally namedauthenticated-encryption mode,oradvanced encryption mode(AEM) andwas shown to be completely insecure in 2019.OCB3, published in 2011, changes again the way offsets are computed and introduces minor performance improvements.
OCB2 was standardized in ISO/IEC19772:2009[3](although it was removed from the standard following the publication of the attack) and a modified OCB3 in RFC7253.[4]The RFC encodes the tag length into the internally formatted nonce.
Performance
[edit]OCB performance overhead is minimal compared to classical, non-authenticating modes likecipher block chaining.OCB requires one block cipher operation per block of encrypted and authenticated message, and one block cipher operation per block of associated data. There is also one extra block cipher operation required at the end of process.
For comparison,CCM modeoffering similar functionality requires twice as many block cipher operations per message block (associated data requires one, as in OCB).
Patents
[edit]While OCB is now public domain, Rogaway initially patented OCB mode so that they could charge for commercial licenses and in attempt to stop their work showing up in military-related projects.[5]Rogaway intentionally abandoned their OCB patents in 2021.[6]
Two U.S. patents were issued for OCB mode.[7]The patents have hindered approval by theNational Institute of Standards and Technology.[citation needed]
While OCB mode was patented, Rogaway made three licenses available to allow OCB mode to be freely used in software licensed under theGNU General Public License(later any open source license certified by theOpen Source Initiative[8]), non-commercial non-military projects, and inOpenSSL.
Since Rogaway only applied for patent protection in the U.S., the algorithm has always been free to use in software not developed and not sold inside the U.S.[9]
Attacks
[edit]Niels Fergusonpointed outcollision attackson OCB, which limits the amount of data that can be securely processed under a single key to about 280 terabytes.[10][11]
In October 2018, Inoue and Minematsu presented anexistential forgery attackagainst OCB2 that requires only a single prior encryption query and almost no computational power or storage.[12]The attack does not extend to OCB1 or OCB3, and it requires that the associated data field of the forged ciphertext be empty. Poettering[13]and Iwata[14]improved the forgery attack to a full plaintext recovery attack just a couple of days later. The four authors later produced a joint report.[15]
See also
[edit]References
[edit]- ^Ted Krovetz, Phillip Rogaway (July 23, 2012)."The OCB Authenticated-Encryption Algorithm".RetrievedMay 28,2012.
- ^Phillip Rogaway."OCB Mode".RetrievedMay 28,2012.
- ^"ISO/IEC 19772:2009 Information technology -- Security techniques -- Authenticated encryption".ISO. 2009-02-12.RetrievedMay 28,2012.
- ^Krovetz, Ted; Rogaway, Phillip (2014)."The OCB Authenticated-Encryption Algorithm".IETF.
- ^Rogaway, Philip."OCB - An Authenticated-Encryption Scheme - Licensing - Rogaway".www.cs.ucdavis.edu.Retrieved31 July2023.
- ^Phillip Rogaway."OCB patents are abandoned; freely usable".mailarchive.ietf.org.Retrieved2021-02-27.
- ^Phillip Rogaway."OCB FAQ - Is OCB Patented".RetrievedMay 28,2012.
- ^Phillip Rogaway (9 January 2013)."OCB: free licenses".
- ^Phillip Rogaway (29 March 2005)."OCB: Offer Letter".RetrievedMay 28,2012.
- ^ Niels Ferguson (2002-02-11)."Collision attacks on OCB"(PDF).
- ^Phillip Rogaway (2015-02-27)."OCB: Background".
- ^ Akiko Inoue and Kazuhiko Minematsu (2018-10-26)."Cryptanalysis of OCB2".
- ^ Bertram Poettering (2018-11-08)."Breaking the confidentiality of OCB2".
- ^ Tetsu Iwata (2018-11-11)."Plaintext Recovery Attack of OCB2".
- ^ Inoue, Akiko; Iwata, Tetsu; Minematsu, Kazuhiko; Poettering, Bertram (2019-03-19)."Cryptanalysis of OCB2: Attacks on Authenticity and Confidentiality".
- Rogaway, Phillip; Bellare, Mihir; Black, John (August 2003)."OCB: A block-cipher mode of operation for efficient authenticated encryption".ACM Transactions on Information and System Security.6(3): 365–403.doi:10.1145/937527.937529.S2CID47050629.Retrieved2018-01-30.