Re: [Cfrg] OCB test vectors reusing nonces

[Matt Caswell <[e-mail]>]

On 28 January 2014 05:21, Manger, James <[e-mail]> wrote:
> Ted,
>
> Attached is my version of the updated test vectors for appendix A of draft-irtf-cfrg-ocb.
>
> The first 16 {N,A,P,C} tuples use incrementing nonces.
>
> I added one example with a 96-bit tag and a separate key (since we recommend using a single tag length with any given key). It uses the same nonce as the 128-bit tag example with the same A and P.
>
> The final examples use incrementing nonces.
>
> I made minor changes to the text.

I have successfully managed to verify all of these proposed test
vectors with my implementation of OCB.

However, I understood that one of your objectives for proposing a
change to the test vectors was to not reuse the same key and nonce
within the tests. This objective has not been achieved in the final
set of 9 more complex tests. Whilst you have incremented the nonce
between each encryption within a test, each test starts with an all
zero nonce and a fixed key.

Also - a more minor nit - your notation for incrementing the nonce
seems odd to me. The nonce is defined as a string of bytes - whereas
in your notation it is treated as an integer which can be incremented.

Matt