Re: [TLS] Inclusion of OCB mode in TLS 1.3

[Aaron Zauner <[e-mail]>]

Alex Elsayed wrote:
> Aaron Zauner wrote:
> 
>> Hi TLS-WG,
>>
>> Over the last couple of days I've again looked into OCB, read the
>> original paper as well as quite some literature on it, patents, CFRG
>> discussion et cetera.
>>
>> OCB looks like an elegant and parallel mode for inclusion in TLS.
>> I've searched through recent TLS-WG discussion, OCB has been
>> mentioned in passing as has EAX(2). When first looking into that my
>> main concerns were:
>>
>>    * IPR/patents: the authors have granted access to OSI licensed
>>      software as well as to commercial (non military!) software for
>>      all use [0] [1].
> <snip>
> 
> Note that while the authors have licensed their patents, IIRC there are 
> still concerns over whether the Gligor & Donescu or Jutla patents [1] apply.
> 
> In addition, I'd like to call the attention of the group to the CAESAR AEAD 
> competition [2], in which there are multiple entrants (and Rogaway &c has 
> submitted a new mode "AEZ" in addition to OCB). There is a mailing list [3] 
> for discussion and a wiki [4] which has collected the entrants, similar to 
> the SHA-3 Zoo.

I've already noted CAESAR in this thread. The problem being: the
competition ends in 2017 as far as I know. Until then we're stuck with
what we have right now (plus ChaCha20/Poly1305 probably).

Aaron

> 
> One thing in particular that may be worth thinking about is that several of 
> the modes proposed are nonce-misuse resistant, akin to SIV.
> 
> 
> [1] 6,963,976, 6,973,187, 7,093,126, and 8,107,620.
> [2] http://competitions.cr.yp.to/caesar.html
> [3] https://groups.google.com/forum/#!forum/crypto-competitions
> [4] http://aezoo.compute.dtu.dk/