IETF Logo Mail Archive

Re: [Cfrg] Request For Comments: OCB Internet-Draft

Simon Josefsson <simon@josefsson.org> Fri, 15 July 2011 07:54 UTC

Return-Path: <simon@josefsson.org>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DDC0521F8777 for <cfrg@ietfa.amsl.com>; Fri, 15 Jul 2011 00:54:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -103.932
X-Spam-Level:
X-Spam-Status: No, score=-103.932 tagged_above=-999 required=5 tests=[AWL=-1.333, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1o7+Yh9OqIIy for <cfrg@ietfa.amsl.com>; Fri, 15 Jul 2011 00:54:32 -0700 (PDT)
Received: from yxa-v.extundo.com (yxa-v.extundo.com [213.115.69.139]) by ietfa.amsl.com (Postfix) with ESMTP id A509E21F876E for <cfrg@irtf.org>; Fri, 15 Jul 2011 00:54:31 -0700 (PDT)
Received: from latte.josefsson.org (c80-216-4-108.bredband.comhem.se [80.216.4.108]) (authenticated bits=0) by yxa-v.extundo.com (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id p6F7sOCR027704 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Fri, 15 Jul 2011 09:54:26 +0200
From: Simon Josefsson <simon@josefsson.org>
To: Ted Krovetz <ted@krovetz.net>
References: <22798CA3-3D49-4652-A5DB-EC25ACCD245C@krovetz.net> <2B90DB3F-327A-45B3-B1AE-C8D19825CF31@krovetz.net>
OpenPGP: id=B565716F; url=http://josefsson.org/key.txt
X-Hashcash: 1:22:110715:cfrg@irtf.org::31wm9EvHKj0CeD9X:2/b3
X-Hashcash: 1:22:110715:ted@krovetz.net::ONbxt3PE4QyYqhV3:5/Gn
Date: Fri, 15 Jul 2011 09:54:23 +0200
In-Reply-To: <2B90DB3F-327A-45B3-B1AE-C8D19825CF31@krovetz.net> (Ted Krovetz's message of "Thu, 14 Jul 2011 17:35:13 -0700")
Message-ID: <87r55sc72o.fsf@latte.josefsson.org>
User-Agent: Gnus/5.110018 (No Gnus v0.18) Emacs/23.2 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
X-Virus-Scanned: clamav-milter 0.97 at yxa-v
X-Virus-Status: Clean
Cc: cfrg@irtf.org
Subject: Re: [Cfrg] Request For Comments: OCB Internet-Draft
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/cfrg>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Fri, 15 Jul 2011 07:54:33 -0000

Ted Krovetz <ted@krovetz.net> writes:

>> It would help if you explained (in the security considerations) what
>> happens if a nonce is repeated.
>
> Nice suggestion. Security is lost if nonces are reused during
> encryption. We've made this clearer in the ID and have resubmitted it
> as draft-krovetz-ocb-02.

Thank you!

Are there any implications for the key if a nonce is repeated?  Let's
say I use the same nonce all the time, and the attacker can do
known-plaintext attacks.  Can the attacker recover the key faster than
he would be able to if the nonces were not repeated?

I'm trying to get AEAD cipher modes to say more than just "the security
properties are lost" when talking about failure modes.  "security
properties are lost" can mean so many things, and it is useful to be
able to rule out some unwanted side effects.

/Simon

v2.23.0 | Report a Bug | By Email