Re: [Cfrg] Attacker changing tag length in OCB

Ted Krovetz <ted@krovetz.net> Wed, 29 May 2013 14:28 UTC

Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 6.3 \(1503\))
From: Ted Krovetz <ted@krovetz.net>
In-Reply-To: <255B9BB34FB7D647A506DC292726F6E1151AC7071C@WSMSG3153V.srv.dir.telstra.com>
Date: Wed, 29 May 2013 07:28:29 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <60CBDD6C-93EA-40D8-8E70-4A17E9EA0736@krovetz.net>
References: <20130528162226.1401.91015.idtracker@ietfa.amsl.com> <255B9BB34FB7D647A506DC292726F6E1151AC7071C@WSMSG3153V.srv.dir.telstra.com>
To: "cfrg@irtf.org" <cfrg@irtf.org>
Subject: Re: [Cfrg] Attacker changing tag length in OCB
Precedence: list

James,

Thanks for looking over the document. I didn't mean for this announcement to get posted here, but a few small edits caused an auto-announcement. Sorry.

As for your concerns... AEAD_AES_128_OCB_TAGLEN128 and AEAD_AES_128_OCB_TAGLEN64 are different algorithms and a protocol will specify or negotiate one or the other, but not allow both simultaneously under the same key.

If for some reason a protocol did want to allow tags valid under either algorithm, then the two algorithms would need to operate under different keys. Just like if you wanted to accept messages with tags valid under either HMAC or CBC-MAC, you'd use different keys for each.

In other words, you are right. Shorter tags are simple truncations of longer tags. But, only a very poorly engineered system would be affected by this fact.

-Ted

[Cfrg] I-D Action: draft-irtf-cfrg-ocb-02.txt internet-drafts
[Cfrg] Attacker changing tag length in OCB Manger, James H
Re: [Cfrg] Attacker changing tag length in OCB Ted Krovetz
Re: [Cfrg] Attacker changing tag length in OCB Blumenthal, Uri - 0558 - MITLL
Re: [Cfrg] Attacker changing tag length in OCB Richard Barnes
Re: [Cfrg] Attacker changing tag length in OCB Igoe, Kevin M.
Re: [Cfrg] Attacker changing tag length in OCB Rene Struik
Re: [Cfrg] Attacker changing tag length in OCB Blumenthal, Uri - 0558 - MITLL
Re: [Cfrg] Attacker changing tag length in OCB David McGrew (mcgrew)
Re: [Cfrg] Attacker changing tag length in OCB Richard Barnes
Re: [Cfrg] Attacker changing tag length in OCB Rene Struik
Re: [Cfrg] Attacker changing tag length in OCB Ted Krovetz
Re: [Cfrg] Attacker changing tag length in OCB Blumenthal, Uri - 0558 - MITLL
Re: [Cfrg] Attacker changing tag length in OCB Dan Brown
Re: [Cfrg] Attacker changing tag length in OCB Manger, James H
Re: [Cfrg] Attacker changing tag length in OCB Dan Brown