Re: [Cfrg] Attacker changing the tag length in OCB

[Dan Brown <[e-mail]>]

> -----Original Message-----
> Phillip Rogaway
> Sent: Monday, June 03, 2013 3:42 PM
> To: [e-mail]
> (-3) I worry that trying to engineer things so that one can safely
> use varying tag lengths with a single key might send a message that
> this is an OK thing to do, contradicting the spec.  Someone might

[DB] Perhaps mistakenly (*), I interpreted some of the emails on this thread
as saying that the spec allows one to vary tag lengths with a single key.  

If the intent of the OCB spec is not to allow variable tag lengths, then I
think the spec needs greater emphasis, especially in view of some IETF
common practices and viewpoints (**).  So, the spec should somewhere say
that "a single key MUST not be used with multiple parameter sets" and "a
decryptor MUST reject a ciphertext if it uses different parameters than for
the key indicated".  

(*) I may have taken the emails out of context (i.e. without studying the
spec first): maybe the emails meant that somebody might contradict the spec.

(**) For example, TLS allows one public key per multiple different cipher
suites (not sure if it allows pre-shared key with different cipher suites).
For another example, PKIX did not accept proposals that allowed, as
optional, detailed algorithm restrictions in certificates.

> even think it appropriate to accept a ciphertext with _any_ provided
> tag length, as long as the ciphertext is deemed valid.  For most
> contexts, that would be disastrous.