OCB mode

From Wikipedia, the free encyclopedia

OCB mode (Offset Codebook Mode) is a mode of operation for cryptographic block ciphers.^[1]^[2]

Encryption and authentication

It was designed to provide both authentication and privacy. It is essentially a scheme for integrating a Message Authentication Code (MAC) into the operation of a block cipher. In this way, OCB mode avoids the need to use two systems; a MAC for authentication and encryption for privacy. This results in lower computational cost compared to the application of separate encryption and authentication functions.

OCB mode was designed by Phillip Rogaway, who credits Mihir Bellare, John Black, and Ted Krovetz with assistance and comments on the designs. It is based on the authenticated encryption mode IAPM due to Charanjit S. Jutla (see the OCB FAQ for more details).

There are three versions of OCB: OCB1, OCB2 and OCB3. OCB1 was published in 2001. OCB2 improves on OCB1 by allowing associated data to be included with the message — that is, data that are not encrypted but should be authenticated — and a new method for generating a sequence of offsets. OCB2 was first published in 2003, originally named AEM (Authenticated-Encryption Mode, or Advanced Encryption Mode). OCB3, published in 2011, changes again the way offsets are computed and introduces minor performance improvements.

OCB mode is listed as an optional method in the IEEE 802.11 wireless security standard as an alternative to CCM. OCB2 is standardized in ISO/IEC 19772:2009.^[3]

Performance

OCB performance overhead is minimal comparing to classical, non-authenticating modes like CBC. OCB requires one block cipher operation per each block of encrypted and authenticated message and one block cipher operation per each block of associated data. There is also one extra block cipher operation required at the end of process.

For comparison, CCM mode offering similar functionality requires twice as many block cipher operations per each message block (associated data requires one as in OCB).

Patents

Two U.S. patents have been issued for OCB mode.^[4] However, a special exemption has been granted so that OCB mode can be used in software licensed under the GNU General Public License without cost, as well as for any non-commercial, non-governmental application. Since the authors have only applied for patent protection in the U.S., the algorithm is free to use in software not developed and not sold inside the U.S.^[5]

As of January 2013, the author has granted a free license for any open source license certified by the Open Source Initiative. ^[6]

Attacks

Not much cryptoanalysis has been done on OCB because of the patent situation. Ferguson found collision attacks on OCB which limits the amount of data that can be securely processed under a single key, in typical cases to not more than 64GB per key ^[7]

References

↑ Ted Krovetz, Phillip Rogaway (July 23, 2012). "The OCB Authenticated-Encryption Algorithm". Retrieved May 28, 2012.
↑ Phillip Rogaway. "OCB Mode". Retrieved May 28, 2012.
↑ "ISO/IEC 19772:2009 Information technology -- Security techniques -- Authenticated encryption". ISO. 2009-02-12. Retrieved May 28, 2012.
↑ Phillip Rogaway. "OCB FAQ - Is OCB Patented". Retrieved May 28, 2012.
↑ Phillip Rogaway (29 March 2005). "OCB: Offer Letter". Retrieved May 28, 2012.
↑ Phillip Rogaway (9 January 2013). "OCB: free licenses".
↑ Niels Ferguson (2002-02-11). "Collision attacks on OCB".

Phillip Rogaway, Mihir Bellare, John Black. OCB: A block-cipher mode of operation for efficient authenticated encryption, ACM Transactions on Information and System Security (TISSEC), Volume 6, Issue 3, pp.365-403. August 2003.
Charanjit S. Jutla, "Encryption Modes with Almost Free Message Integrity", Proc. Eurocrypt 2001, LNCS 2045, May 2001.

External links

v t e Block ciphers (security summary)

Common algorithms	AES Blowfish DES Triple DES Serpent Twofish

Less common algorithms	Camellia CAST-128 IDEA RC2 RC5 SEED Skipjack TEA XTEA

Other algorithms	3-Way Akelarre Anubis ARIA BaseKing BassOmatic BATON BEAR and LION CAST-256 Chiasmus CIKS-1 CIPHERUNICORN-A CIPHERUNICORN-E CLEFIA CMEA Cobra COCONUT98 Crab Cryptomeria/C2 CRYPTON CS-Cipher DEAL DES-X DFC E2 FEAL FEA-M FROG G-DES GOST Grand Cru Hasty Pudding cipher Hierocrypt ICE IDEA NXT Intel Cascade Cipher Iraqi KASUMI KeeLoq KHAZAD Khufu and Khafre KN-Cipher Ladder-DES Libelle LOKI97 LOKI89/91 Lucifer M6 M8 MacGuffin Madryga MAGENTA MARS Mercy MESH MISTY1 MMB MULTI2 MultiSwap New Data Seal NewDES Nimbus NOEKEON NUSH PRESENT Q RC6 REDOC Red Pike S-1 SAFER SAVILLE SC2000 SHACAL SHARK Simon SMS4 Speck Spectr-H64 Square SXAL/MBAL Threefish Treyfer UES Xenon xmx XXTEA Zodiac

Design	Feistel network Key schedule Lai-Massey scheme Product cipher S-box P-box SPN Avalanche effect Block size Key size Key whitening No weak keys

Attack (cryptanalysis)	Brute-force (EFF DES cracker) MITM Linear (Piling-up lemma) Differential (Impossible Truncated Higher-order) Differential-linear Integral (aka Square) Boomerang Mod n Related-key Slide Rotational Timing XSL Interpolation Partitioning Davies' Rebound

Standardization	AES process CRYPTREC NESSIE

Utilization	Initialization vector Mode of operation Padding

v t e Cryptographic hash functions and message authentication codes (MACs) (Security summary)

Common functions	MD5 SHA-1 SHA-2 SHA-3/Keccak

SHA-3 finalists	BLAKE Grøstl JH Skein

Other functions	FSB ECOH GOST HAS-160 HAVAL LM hash MDC-2 MD2 MD4 MD6 N-Hash RadioGatún RIPEMD RTR0 SipHash Snefru SWIFFT Tiger VSH WHIRLPOOL crypt(3) (DES)

MAC algorithms	DAA CBC-MAC HMAC OMAC/CMAC PMAC VMAC UMAC Poly1305-AES

Authenticated encryption modes	CCM CWC EAX GCM IAPM OCB

Attacks	Collision attack Preimage attack Birthday attack Brute force attack Rainbow table Distinguishing attack Side-channel attack

Design	Avalanche effect Hash collision Merkle–Damgård construction

Standardization	CRYPTREC NESSIE NIST hash function competition

Utilization	Salt

v t e Cryptography

History of cryptography Cryptanalysis Cryptography portal Outline of cryptography

Symmetric-key algorithm Block cipher Stream cipher Public-key cryptography Cryptographic hash function Message authentication code Random numbers Steganography

This article is issued from Wikipedia. The text is available under the Creative Commons Attribution/Share Alike; additional terms may apply for the media files.