Re: [Cfrg] RG Last Call - draft-irtf-cfrg-ocb-00

"David McGrew (mcgrew)" <> Tue, 12 February 2013 12:52 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 2DA1921F8D60 for <>; Tue, 12 Feb 2013 04:52:34 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -110.099
X-Spam-Status: No, score=-110.099 tagged_above=-999 required=5 tests=[AWL=-0.299, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, SARE_SUB_RAND_LETTRS4=0.799, USER_IN_WHITELIST=-100]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id v7fhED6X9AVe for <>; Tue, 12 Feb 2013 04:52:33 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 7D16F21F8D55 for <>; Tue, 12 Feb 2013 04:52:33 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;;; l=1531; q=dns/txt; s=iport; t=1360673553; x=1361883153; h=from:to:subject:date:message-id:in-reply-to:content-id: content-transfer-encoding:mime-version; bh=lasc5Q1qdCcA+8KpUke2WYeroPNJKiQMMP9MKuJoiBk=; b=TvORRQeoaT8qc9PYq8OWH2a/8ABO7AdWqRiVLZH+mqfeBqjdvV1d6vMI 4jGb0JC1hrft5baAJBCJ0yE3SOEAVwewVXu4XvIGFds2KXFe+rMATFC+M A/z7Do4SOQGYiz8UUlQV9ulpwW+/a3ctb9eBeXd4zbSJDpDRvhIliP/DX w=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: Av8EAHc6GlGtJV2b/2dsb2JhbABEwToWc4IfAQEBAwE6UQEIIhRCJQIEARIIiAQGrn+QE5EkYQOmd4MGgic
X-IronPort-AV: E=Sophos;i="4.84,650,1355097600"; d="scan'208";a="175935962"
Received: from ([]) by with ESMTP; 12 Feb 2013 12:52:33 +0000
Received: from ( []) by (8.14.5/8.14.5) with ESMTP id r1CCqWkk017328 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Tue, 12 Feb 2013 12:52:32 GMT
Received: from ([]) by ([]) with mapi id 14.02.0318.004; Tue, 12 Feb 2013 06:52:32 -0600
From: "David McGrew (mcgrew)" <>
To: Ted Krovetz <>, "" <>
Thread-Topic: [Cfrg] RG Last Call - draft-irtf-cfrg-ocb-00
Thread-Index: AQHOCEmHJvaAhcymBkmt/Ok73yAjpZh1O2KAgAADjgCAAB9PAIAA4ZQA
Date: Tue, 12 Feb 2013 12:52:32 +0000
Message-ID: <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
user-agent: Microsoft-MacOutlook/
x-originating-ip: []
Content-Type: text/plain; charset="us-ascii"
Content-ID: <>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: Re: [Cfrg] RG Last Call - draft-irtf-cfrg-ocb-00
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 12 Feb 2013 12:52:34 -0000

Hi Ted,

On 2/11/13 1:25 PM, "Ted Krovetz" <> wrote:

>> I'd still like to see clarifications (answers to my example questions)
>> regarding License 1.
>I'm going to pass your thorny license questions off to Phil. I'll
>continue to manage any comments on the RFC draft itself.
>Any comments on the draft?

I did another read of the draft, and put down some thoughts.

This is a nicely written draft; it reads well.  It clearly deserves to be
published as an RFC.

It would be good to have more prescriptive text about nonce use in the
algorithm description.

I think "OCB encryption and decryption employ a nonce N, which must be
selected as a new value for each message encrypted." can be said more
clearly.   Perhaps "a nonce N; the value of the nonce MUST be distinct for
each distinct invocation of the OCB encryption operation".

In Section 4.2., after "This function computes a ciphertext (which
includes a bundled authentication tag) when given a plaintext, associated
data, nonce and key." I suggest adding "For each invocation of
OCB-ENCRYPT, the value of the Nonce input MUST be distinct."

In the security considerations, why not say 2^64 instead of 2^{128/2}?

Paragraphs 3 and 4 of the Security Considerations section have a good
description of the security degradation due to nonce reuse.   I think it
would be a good idea to make these paragraphs a separate subsection, so
that they show up in the table of contents.