Re: [Cfrg] WG last call on latest OCB draft.

[David Jacobson <[e-mail]>]

On 6/12/13 7:08 AM, Ted Krovetz wrote:
> Thanks Kevin for pushing OCB along.
>
>> 2) OCB is too widespread to make such a substantive change at this late date.
> Actually, Phil and I have decided to make the change. We agree that it is a good idea, and since we figured out how to do it without affecting existing users of 128-bit tags, we think it's worth the break.
>
> A draft that makes the change will be posted later today or tomorrow. It will not need much changing over -02, so hopefully it won't take much further review.
>
> -Ted
[snip]

And just an only semi-relevant little point:  The key derivation 
functions in SP 800-108 all include the number of output bits in the 
computation.  So if you use exactly the same key, label, and context, 
and generate a 128 bit key and a 256 bit key, the two keys are 
completely different.  They could have not done that and instead made 
the argument that people should know better than to... .  I think that 
mixing the output length into the computation of both KDFs and 
authentication tags is good.

     --David