OCB mode

OCB mode (Offset Codebook Mode) is an authenticated encryption mode of operation for cryptographic block ciphers.[1][2] OCB mode was designed by Phillip Rogaway, who credits Mihir Bellare, John Black, and Ted Krovetz with assistance and comments on the designs. It is based on the authenticated encryption mode IAPM due to Charanjit S. Jutla.

Encryption and authentication

OCB mode was designed to provide both message authentication and privacy. It is essentially a scheme for integrating a Message Authentication Code (MAC) into the operation of a block cipher. In this way, OCB mode avoids the need to use two systems: a MAC for authentication and encryption for privacy. This results in lower computational cost compared to using separate encryption and authentication functions.

There are three versions of OCB: OCB1, OCB2 and OCB3. OCB1 was published in 2001. OCB2 improves on OCB1 by allowing associated data to be included with the message (providing AEAD) — that is, data that are not encrypted but should be authenticated — and a new method for generating a sequence of offsets. OCB2 was first published in 2003, originally named AEM (Authenticated-Encryption Mode, or Advanced Encryption Mode). OCB3, published in 2011, changes again the way offsets are computed and introduces minor performance improvements.

OCB mode is listed as an optional method in the IEEE 802.11 wireless security standard as an alternative to CCM. OCB2 is standardized in ISO/IEC 19772:2009[3] and a modified OCB3 in RFC 7253.[4] The RFC encodes the tag length into the internally formatted nonce.

Performance

OCB performance overhead is minimal compared to classical, non-authenticating modes like CBC. OCB requires one block cipher operation per block of encrypted and authenticated message, and one block cipher operation per block of associated data. There is also one extra block cipher operation required at the end of process.

For comparison, CCM mode offering similar functionality requires twice as many block cipher operations per message block (associated data requires one, as in OCB).

Patents

Two U.S. patents have been issued for OCB mode.[5] However, a special exemption has been granted so that OCB mode can be used in software licensed under the GNU General Public License without cost, as well as for any non-commercial, non-governmental application. Since the authors have only applied for patent protection in the U.S., the algorithm is free to use in software not developed and not sold inside the U.S.[6]

As of January 2013, the author has granted a free license for any open source license certified by the Open Source Initiative.[7]

Attacks

Niels Ferguson found collision attacks on OCB, which limits the amount of data that can be securely processed under a single key, in typical cases to not more than 64GB per key.[8]

See also

References

  1. ↑ Ted Krovetz, Phillip Rogaway (July 23, 2012). "The OCB Authenticated-Encryption Algorithm". Retrieved May 28, 2012.
  2. ↑ Phillip Rogaway. "OCB Mode". Retrieved May 28, 2012.
  3. ↑ "ISO/IEC 19772:2009 Information technology -- Security techniques -- Authenticated encryption". ISO. 2009-02-12. Retrieved May 28, 2012.
  4. ↑ "The OCB Authenticated-Encryption Algorithm". IETF. 2014.
  5. ↑ Phillip Rogaway. "OCB FAQ - Is OCB Patented". Retrieved May 28, 2012.
  6. ↑ Phillip Rogaway (29 March 2005). "OCB: Offer Letter". Retrieved May 28, 2012.
  7. ↑ Phillip Rogaway (9 January 2013). "OCB: free licenses".
  8. ↑ Niels Ferguson (2002-02-11). "Collision attacks on OCB" (PDF).
This article is issued from Wikipedia - version of the 11/3/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.