OCB mode (Offset Codebook Mode) is a mode of operation for cryptographic block ciphers.
Contents |
It was designed to provide both authentication and privacy. It is essentially a scheme for integrating a Message Authentication Code (MAC) into the operation of a block cipher. In this way, OCB mode avoids the need to use two systems; a MAC for authentication and a block cipher encryption for privacy. This results in lower computational cost compared to the application of separate encryption and authentication functions.
OCB mode was designed by Phillip Rogaway, who credits Mihir Bellare, John Black, and Ted Krovetz with assistance and comments on the designs. It is based on the authenticated encryption mode IAPM due to Charanjit S. Jutla (see the OCB FAQ for more details).
There are two versions of OCB: 1.0 and 2.0. OCB 2.0 improves on 1.0 by allowing associated data to be included with the message — that is, data that are not encrypted but should be authenticated — and a new method for generating a sequence of offsets. OCB 2.0 was first published in 2003, originally named AEM (Authenticated-Encryption Mode, or Advanced Encryption Mode).
OCB mode is listed as an optional method in the IEEE 802.11 wireless security standard as an alternative to CCM.
OCB performance overhead is minimal comparing to classical, non-authenticating modes like CBC. OCB requires one block cipher encryption per each block of encrypted and authenticated message and one encryption per each block of additional associated data. There are also two extra encryptions required at the end of process.
For comparison, CCM mode offering similar functionality requires twice as many encryptions per each message block (associated data requires one as in OCB).
Two U.S. patents have been issued for OCB mode. [1] However, a special exemption has been granted so that OCB mode can be used in software licensed under the GNU General Public License without cost, as well as for any non-commercial, non-governmental application. Since the authors have only applied for patent protection in the U.S., the algorithm is free to use in software not developed and not sold inside the U.S. [2].