Re: [secdir] [Cfrg] ISE seeks help with some crypto drafts

[Tony Arcieri <[e-mail]>]

On Fri, Mar 8, 2019 at 9:53 AM Paul Wouters <[e-mail]> wrote:

> I have strong reservations about the ocb draft. Rogaway has patents
> on OCB, and has put constrains on its use and there is no generic IPR
> statement that the IETF normally likes to see for work published as
> RFC. Until such a time, I do not think publishing RFC's with OCB is
> advised. A few years ago I asked the TLS OCB authors about extending
> their allowed usage to IKE/IPsec and they told me this use was not
> covered by Rogaway's license to them. While this has since changed a bit,
> and there is no longer a specific TLS-only license, other constrains are
> still in place.  Specifying OCB documents that cannot be implemented or
> deployed indiscriminatory is troublesome.
>

I would agree the IPR story for OCB is presently bad.

Rogaway had previously voiced interest in completely resolving the patent
situation (i.e. disavowing the patents, with an attorney's assistance)
however sadly it seems he never completed this work. Perhaps I can attempt
to get the ball rolling on that again...

Second, I'm not a cryptographer, but it seems OCB has recently seen some
> attacks that might impact the security of OCB:
>
> Cryptanalysis of OCB2
> https://eprint.iacr.org/2018/1040
>
> Breaking the confidentiality of OCB2
> https://eprint.iacr.org/2018/1087
>
> Plaintext Recovery Attack of OCB2
> https://eprint.iacr.org/2018/1090


There are three variants of OCB: OCB1, OCB2, and OCB3.

These attacks apply to OCB2. They do not apply to OCB1 or OCB3.

OCB3 is realistically what we should be using provided the IPR story can be
cleared up.

-- 
Tony Arcieri