Re: [TLS] Inclusion of OCB mode in TLS 1.3

[Alex Elsayed <[e-mail]>]

Aaron Zauner wrote:

> Hi TLS-WG,
> 
> Over the last couple of days I've again looked into OCB, read the
> original paper as well as quite some literature on it, patents, CFRG
> discussion et cetera.
> 
> OCB looks like an elegant and parallel mode for inclusion in TLS.
> I've searched through recent TLS-WG discussion, OCB has been
> mentioned in passing as has EAX(2). When first looking into that my
> main concerns were:
> 
>    * IPR/patents: the authors have granted access to OSI licensed
>      software as well as to commercial (non military!) software for
>      all use [0] [1].
<snip>

Note that while the authors have licensed their patents, IIRC there are 
still concerns over whether the Gligor & Donescu or Jutla patents [1] apply.

In addition, I'd like to call the attention of the group to the CAESAR AEAD 
competition [2], in which there are multiple entrants (and Rogaway &c has 
submitted a new mode "AEZ" in addition to OCB). There is a mailing list [3] 
for discussion and a wiki [4] which has collected the entrants, similar to 
the SHA-3 Zoo.

One thing in particular that may be worth thinking about is that several of 
the modes proposed are nonce-misuse resistant, akin to SIV.


[1] 6,963,976, 6,973,187, 7,093,126, and 8,107,620.
[2] http://competitions.cr.yp.to/caesar.html
[3] https://groups.google.com/forum/#!forum/crypto-competitions
[4] http://aezoo.compute.dtu.dk/