Re: [Cfrg] Attacker changing tag length in OCB

["Manger, James H" <[e-mail]>]

David McGrew said
> Agreed.  The poor choice that is relevant here is the use of the same OCB secret key with two different tag lengths.   If someone uses a single key in both AEAD_AES_128_OCB_TAGLEN64 and AEAD_AES_128_OCB_TAGLEN128, then it is likely that they have also not satisfied the nonce uniqueness requirements, so the tag truncation and substitution attack seems like the least of their worries.   (Given two distinct nonce/associated data/plaintext tuples with identical nonces, it is easy for the attacker to craft forgeries.)


Only a sender has to ensure nonces are unique. Even if a sender is completely diligent with nonces and only uses a fixed tag length with any given key, the problem of variable-length tags remains. What matters is whether a *recipient* accepts shorter tags than the sender uses.

It is good crypto hygiene only to use a given key with a single algorithm. It wasn't obvious to me whether different tag lengths for the same algorithm counted as a "single algorithm". Nor whether this hygiene was "nice" or "crucial" in this situation.

I agree with Peter Gutmann that it is a case of "when" not "if" the first misuse occurs. In many systems it is not easy to specify one algorithm at the same point where you provide the key.

Mixing the tag length into the ciphertext might even be a nice selling point for adopting OCB over other AEAD algorithms ;-)

At an absolute minimum, could a warning be added to draft-irtf-cfrg-ocb stating that any given key MUST only be used with one tag length. Probably in the 2nd-last paragraph of section 3 "OCB Global Parameters", and also in section 5 "Security Considerations".


Dan Brown said:
> 2) I'm uncertain whether modifying the message and substituting a shorter tag, per Rogaway and Wagner, [is an attack] because the authenticity is determined by the tag length, at least in CCM. In other words, calling this is an attack is conferring some level if authentication to the symmetric cipher.  That's a classic mistake. Any proposed fixes to this alleged problem had better not make this mistake.

It might not be an attack on an algorithm, but can we call it an attack on a system that implements a suite of algorithms?

--
James Manger