Re: [Cfrg] [secdir] ISE seeks help with some crypto drafts

[Tony Arcieri <[e-mail]>]

On Sun, Mar 10, 2019 at 12:10 PM Benjamin Kaduk <[e-mail]> wrote:

> > I would like to remind everyone that OCB is not a "new mode". It is
> specified in RFC 7253. This work generalizes the specification -- without
> changing the 128-bit block case -- to allow other block cipher block
> lengths.
>
> It's still a "distinct choice that a protocol designer (or user) picking a
> cipher has available to choose from", which is where the perceived downside
> of new things comes from.  My apologies for conflating the technical term
> with the generic.


I think there are significant compelling reasons to prefer OCB mode over
pretty much all other existing modes:

- Recent CAESAR winner (one of many in the portfolio, but)
- Fast anywhere AES is fast. No CLMUL required (good for embedded)
- Well-studied: IMO OCB is more likely than not be covered in
classes/textbooks on symmetric cryptography

I think the IPR concerns are the main reason it has not seen more
widespread adoption.

If you were to ask me "Is it better than AES-GCM?", my answer is yes. OCB
hits the sweet spot of being a construction which is "fast everywhere", as
opposed to the split between AES-GCM and AES-CCM we see between
desktops/servers/high-end mobile vs embedded devices.

The wide block modes are a different question. I think they're potentially
interesting in use cases I'm not particularly familiar with (e.g. mixnets).
I'm not going to be the one to champion those through the CFRG, though.

That said, the inability to use OCB mode in IETF protocols (due to IPR
concerns) is a travesty, and hopefully one we can clear up.

--
Tony Arcieri