[Cfrg] Attacker changing tag length in OCB

["Manger, James H" <[e-mail]>]

> 	Title           : The OCB Authenticated-Encryption Algorithm
> 	Filename        : draft-irtf-cfrg-ocb-02.txt
> http://tools.ietf.org/html/draft-irtf-cfrg-ocb-02

OCB with tag lengths of 64, 96, and 128 bits are defined. 64-bit and 96-bit tags are simply truncated 128-bit tags. The tag length is not mixed into the ciphertext. It never affects any input to an AES operation.

Consequently, given a valid output from the AEAD_AES_128_OCB_TAGLEN128 algorithm it is trivial to produce a valid output from the AEAD_AES_128_OCB_TAGLEN64 algorithm -- just drop the last 8 bytes.

Is this ok?

Another consequence is that an attacker wanting to change the additional data (eg from saying "TOP SECRET" to "PUBLIC") while keeping the same plaintext only has to defeat the shortest tag a recipient accepts, regardless of the tag applied by the originator.

Is this ok? It doesn’t feel ok.

Of course if a recipient accepts 64-bit tags an attacker can forge messages with a probability of 2^-64. However, that doesn’t seem to be exactly the same as forging a message with the same plaintext as a message originally authenticated with a 128-bit tag.

Would OCB be better if the algorithms with different tag lengths couldn’t affect each other? Perhaps restricting the nonce to <126 bits (instead of <128 bits) and encoding the tag length in 2 bits.

--
James Manger