I've been looking into the OCB cipher mode and everything I hear sounds good. I was planning on implementing it.
Everything except for this lone voice, that is: Collision attacks on OCB:
We show that collision attacks are quite effective on the OCB block cipher mode. When a collision occurs OCB loses its authentication capability. To keep adequate authentication security OCB has to be limited in the amount of data it processes. This restriction is relevant to real-life applications, and casts doubt on the wisdom of using OCB.
Does this mean that I should definitely stay away from OCB? I did read the paper but I'm not experienced enough to be sure how serious this really is.