Re: [TLS] Inclusion of OCB mode in TLS 1.3

[Aaron Zauner <[e-mail]>]

Jack Lloyd wrote:
> 
> OCB mode as defined in RFC 7253 supports nonces of at most 120 bits.
> 
> When used in TLS both GCM and CCM use 96 bit nonces, 32 from key
> exchange and 64 explicit in the message. Given the 2^64 message limit
> (and that any sensible implementation just uses the sequence number
> for the 64 nonce bits included in each message) I don't see why OCB
> should require anything different. A 128 bit nonce isn't increasing
> the security level when it is already 100% guaranteed that the nonce
> will never repeat using just 96.
> 
> Another option would be to avoid explicit nonces entirely and
> following ChaCha20 define the nonce to always be exactly the sequence
> number in network order. This value is known to be unique for protocol
> reasons, and it avoids the wire bytes taken for any explicit value.
> 
Yes, thanks! I figured that out on my own a couple of days ago.
Unfortunately the ID I submitted still has the TAGLEN128 constructs in
it (I forgot to edit this part). So there's probably going to be a -01.
Let's see if my submission gets accepted.

Thanks for your feedback,
Aaron