Appendix A. Sample Results This section gives sample output values for various inputs when using OCB with AES as per the parameters defined in Section 3.1. All strings are represented in hexadecimal (eg, 0F represents the bitstring 00001111). The following 16 (N,A,P,C) tuples show the ciphertext C that results from OCB-ENCRYPT(K,N,A,P) for various lengths of associated data (A) and plaintext (P). The key (K) has a fixed value, the tag length is 128 bits, and the the nonce (N) increments. K: 000102030405060708090A0B0C0D0E0F An empty entry indicates the empty string. N: BBAA99887766554433221100 A: P: C: 785407BFFFC8AD9EDCC5520AC9111EE6 N: BBAA99887766554433221101 A: 0001020304050607 P: 0001020304050607 C: 6820B3657B6F615A5725BDA0D3B4EB3A257C9AF1F8F03009 N: BBAA99887766554433221102 A: 0001020304050607 P: C: 81017F8203F081277152FADE694A0A00 N: BBAA99887766554433221103 A: P: 0001020304050607 C: 45DD69F8F5AAE72414054CD1F35D82760B2CD00D2F99BFA9 N: BBAA99887766554433221104 A: 000102030405060708090A0B0C0D0E0F P: 000102030405060708090A0B0C0D0E0F C: 571D535B60B277188BE5147170A9A22C3AD7A4FF3835B8C5 701C1CCEC8FC3358 N: BBAA99887766554433221105 A: 000102030405060708090A0B0C0D0E0F P: C: 8CF761B6902EF764462AD86498CA6B97 N: BBAA99887766554433221106 A: P: 000102030405060708090A0B0C0D0E0F C: 5CE88EC2E0692706A915C00AEB8B2396F40E1C743F52436B DF06D8FA1ECA343D N: BBAA99887766554433221107 A: 000102030405060708090A0B0C0D0E0F1011121314151617 P: 000102030405060708090A0B0C0D0E0F1011121314151617 C: 1CA2207308C87C010756104D8840CE1952F09673A448A122 C92C62241051F57356D7F3C90BB0E07F N: BBAA99887766554433221108 A: 000102030405060708090A0B0C0D0E0F1011121314151617 P: C: 6DC225A071FC1B9F7C69F93B0F1E10DE N: BBAA99887766554433221109 A: P: 000102030405060708090A0B0C0D0E0F1011121314151617 C: 221BD0DE7FA6FE993ECCD769460A0AF2D6CDED0C395B1C3C E725F32494B9F914D85C0B1EB38357FF N: BBAA9988776655443322110A A: 000102030405060708090A0B0C0D0E0F1011121314151617 18191A1B1C1D1E1F P: 000102030405060708090A0B0C0D0E0F1011121314151617 18191A1B1C1D1E1F C: BD6F6C496201C69296C11EFD138A467ABD3C707924B964DE AFFC40319AF5A48540FBBA186C5553C68AD9F592A79A4240 N: BBAA9988776655443322110B A: 000102030405060708090A0B0C0D0E0F1011121314151617 18191A1B1C1D1E1F P: C: FE80690BEE8A485D11F32965BC9D2A32 N: BBAA9988776655443322110C A: P: 000102030405060708090A0B0C0D0E0F1011121314151617 18191A1B1C1D1E1F C: 2942BFC773BDA23CABC6ACFD9BFD5835BD300F0973792EF4 6040C53F1432BCDFB5E1DDE3BC18A5F840B52E653444D5DF N: BBAA9988776655443322110D A: 000102030405060708090A0B0C0D0E0F1011121314151617 18191A1B1C1D1E1F2021222324252627 P: 000102030405060708090A0B0C0D0E0F1011121314151617 18191A1B1C1D1E1F2021222324252627 C: D5CA91748410C1751FF8A2F618255B68A0A12E093FF45460 6E59F9C1D0DDC54B65E8628E568BAD7AED07BA06A4A69483 A7035490C5769E60 N: BBAA9988776655443322110E A: 000102030405060708090A0B0C0D0E0F1011121314151617 18191A1B1C1D1E1F2021222324252627 P: C: C5CD9D1850C141E358649994EE701B68 N: BBAA9988776655443322110F A: P: 000102030405060708090A0B0C0D0E0F1011121314151617 18191A1B1C1D1E1F2021222324252627 C: 4412923493C57D5DE0D700F753CCE0D1D2D95060122E9F15 A5DDBFC5787E50B5CC55EE507BCB084E479AD363AC366B95 A98CA5F3000B1479 Next are several internal values generated during the OCB-ENCRYPT computation for the last test vector listed above. L_* : C6A13B37878F5B826F4F8162A1C8D879 L_$ : 8D42766F0F1EB704DE9F02C54391B075 L_0 : 1A84ECDE1E3D6E09BD3E058A8723606D L_1 : 3509D9BC3C7ADC137A7C0B150E46C0DA bottom : 15 (decimal) Ktop : 9862B0FDEE4E2DD56DBA6433F0125AA2 Stretch : 9862B0FDEE4E2DD56DBA6433F0125AA2FAD24D13A063F8B8 Offset_0 : 587EF72716EAB6DD3219F8092D517D69 Offset_1 : 42FA1BF908D7D8D48F27FD83AA721D04 Offset_2 : 77F3C24534AD04C7F55BF696A434DDDE Offset_* : B152F972B3225F459A1477F405FC05A7 Checksum_1: 000102030405060708090A0B0C0D0E0F Checksum_2: 10101010101010101010101010101010 Checksum_*: 30313233343536379010101010101010 The next tuple shows a result with a tag length of 96 bits, and a different key. K: 0F0E0D0C0B0A09080706050403020100 N: BBAA9988776655443322110D A: 000102030405060708090A0B0C0D0E0F1011121314151617 18191A1B1C1D1E1F2021222324252627 P: 000102030405060708090A0B0C0D0E0F1011121314151617 18191A1B1C1D1E1F2021222324252627 C: 1792A4E31E0755FB03E31B22116E6C2DDF9EFD6E33D536F1 A0124B0A55BAE884ED93481529C76B6AD0C515F4D1CDD4FD AC4F02AA The following algorithm tests a wider variety of inputs. Results are given for each parameter set defined in Section 3.1. K = zeros(KEYLEN) // Keylength of AES in use C = N = zeros(96) // incremented before each use for i = 0 to 127 do S = zeros(8i) // i bytes of zeros N = N + 1 C = C || OCB-ENCRYPT(K,N,S,S) N = N + 1 C = C || OCB-ENCRYPT(K,N,,S) N = N + 1 C = C || OCB-ENCRYPT(K,N,S,) end for N = N + 1 // 00...0181 after 385 increments Output : OCB-ENCRYPT(K,N,C,) Iteration i of the loop adds 2i + (3 * TAGLEN / 8) bytes to C, resulting in an ultimate length for C of 22,400 bytes when TAGLEN == 128, 20,864 bytes when TAGLEN == 192, and 19,328 bytes when TAGLEN == 64. The final OCB-ENCRYPT has an empty plaintext component, so serves only to authenticate C. The output should be: AEAD_AES_128_OCB_TAGLEN128 Output: 3BF56C859EE1B681A8FAB4A10555ED8C AEAD_AES_192_OCB_TAGLEN128 Output: ABC1D9B629424554711CD422A19B494E AEAD_AES_256_OCB_TAGLEN128 Output: E4211254DA83A7A214164737406FAE87 AEAD_AES_128_OCB_TAGLEN96 Output : 925F0B95EF30F4898F9396AE AEAD_AES_192_OCB_TAGLEN96 Output : 69434D965B7A25181DE57BCE AEAD_AES_256_OCB_TAGLEN96 Output : 6D42DCB34C049827F8B215B4 AEAD_AES_128_OCB_TAGLEN64 Output : 9CE36F3F3EDAC417 AEAD_AES_192_OCB_TAGLEN64 Output : EE007B09138A4782 AEAD_AES_256_OCB_TAGLEN64 Output : 98F52C2E412BA610