Re: [Cfrg] Attacker changing the tag length in OCB

["Manger, James H" <[e-mail]>]

Phil Rogaway said:
>     (1) Require the nonce N to be 120 or fewer bits (right now,
>         we allow up to 127 bits);
> 
>     (2) In the definition of OCB, replace the step
>           Nonce = zeros(127-bitlen(N)) || 1 || N
>         by
>           Nonce = taglen || zeros(120-bitlen(N)) || 1 || N
>         where taglen is the 7-bit binary representation of (TAGLEN mod 128)
> 
> I think it's a good approach, designed to ensure that there's no change
> to OCB when the tag length is 128 bits (which we think is the the
> customary choice).   And "conventional" AEAD security is trivially
> maintained.
> 
> There are arguments both for and against making such a change:
> (+1) I think it does add a measure of robustness to have the
> "ciphertext core" meaningfully vary with the tag length. 
...
> When I weigh the pluses and minuses, I'm of the opinion that it
> is reasonable to go either way.   Ted leans towards making
> the change.   Neither of us feels strongly about it.
> If there is a consensus on this mailing list in favor of
> the change, Ted and I will make it.


I'm +1 on making this change.
I would also add text saying "any given key MUST only be used with one tag length" -- since the aim of the change isn't to promote using one key with multiple tag lengths, but to add a measure of robustness even if a decryptor fails to properly enforce once-key-one-tag-length.

--
James Manger