Re: [Cfrg] Attacker changing the tag length in OCB

["Jack Lloyd" <[e-mail]>]

On Tue, Jun 04, 2013 at 05:49:06PM +0000, Dan Brown wrote:

> If the intent of the OCB spec is not to allow variable tag lengths, then I
> think the spec needs greater emphasis, especially in view of some IETF
> common practices and viewpoints (**).  So, the spec should somewhere say
[...]
> (**) For example, TLS allows one public key per multiple different cipher
> suites (not sure if it allows pre-shared key with different cipher suites).

To address TLS-PSK specifically - using a single PSK with several
different cipher suites is allowed, though as the actual symmetric
keys are derived from both the PSK and the client and server nonces
(and, optionally, a DH/ECDH key exchange), the actual OCB key would
never be reused in a different context, or even in a different session
with the same parameter set.

-Jack