Re: [Cfrg] RG Last Call - draft-irtf-cfrg-ocb-00

["David McGrew (mcgrew)" <[e-mail]>]

Hi Ted,

On 2/11/13 1:25 PM, "Ted Krovetz" <[e-mail]> wrote:

>
>> I'd still like to see clarifications (answers to my example questions)
>> regarding License 1.
>
>I'm going to pass your thorny license questions off to Phil. I'll
>continue to manage any comments on the RFC draft itself.
>
>Any comments on the draft?
>
>Thanks,
>Ted

I did another read of the draft, and put down some thoughts.

This is a nicely written draft; it reads well.  It clearly deserves to be
published as an RFC.

It would be good to have more prescriptive text about nonce use in the
algorithm description.

I think "OCB encryption and decryption employ a nonce N, which must be
selected as a new value for each message encrypted." can be said more
clearly.   Perhaps "a nonce N; the value of the nonce MUST be distinct for
each distinct invocation of the OCB encryption operation".

In Section 4.2., after "This function computes a ciphertext (which
includes a bundled authentication tag) when given a plaintext, associated
data, nonce and key." I suggest adding "For each invocation of
OCB-ENCRYPT, the value of the Nonce input MUST be distinct."


In the security considerations, why not say 2^64 instead of 2^{128/2}?

Paragraphs 3 and 4 of the Security Considerations section have a good
description of the security degradation due to nonce reuse.   I think it
would be a good idea to make these paragraphs a separate subsection, so
that they show up in the table of contents.

Thanks,

David