8

I've been looking into the OCB cipher mode and everything I hear sounds good. I was planning on implementing it.

Everything except for this lone voice, that is: Collision attacks on OCB:

We show that collision attacks are quite effective on the OCB block cipher mode. When a collision occurs OCB loses its authentication capability. To keep adequate authentication security OCB has to be limited in the amount of data it processes. This restriction is relevant to real-life applications, and casts doubt on the wisdom of using OCB.

Does this mean that I should definitely stay away from OCB? I did read the paper but I'm not experienced enough to be sure how serious this really is.

Improve this question
1
  • How much data are you going to use with it? How long do you expect to use that data? How valuable is the data? These questions will help answer whether the weakness is significant to you. Some people still use 3DES. Note that the attack compromises authentication but not confidentiality. @d-w is correct that the published attack requires a lot of encrypted data, and that cryptography is only part of a secure system. Ideally encryption is a 2nd tier defense. It is preferable that an attacker never even get access to your encrypted data.
    – this.josh
    Commented Jun 26, 2011 at 7:11

1 Answer 1

Reset to default
8

Those attacks are theoretical and unlikely to be of much practical relevance to all but a tiny number of uses (if any). Don't let the paper scare you. It is a useful piece of research that will be of interest to researchers, by a reputable and talented cryptographer, but in my opinion it doesn't threaten practical use of OCB.

The kind of collision attacks that Ferguson is talking about require about 268 bytes of data to be encrypted under OCB (all with a single key) before they are likely to occur. That is a lot of data. No typical application is ever going to encrypt that much data under a single key.

You have to keep these things in perspective. If this is the biggest weakness in your system, you have done a fantastically, unbelievably outstanding job of building a security system. I doubt I have ever in my life seen a security system where OCB would be the weakest link. In practice, usability problems, implementation vulnerabilities, misconfiguration, and the like are far greater risks. It's far more likely that a user will choose a poor password, or fall for a social engineering attack, or that your software will have a SQL injection vulnerability, etc. With modern cryptography, attackers usually don't try to break the cryptomath; instead, they bypass it.

Improve this answer
1
  • 2
    For completeness, basic encryption in CBC mode with a 128-bit block cipher also begins to run into trouble when hitting the 2^64 block limit -- which is precisely why AES was designed with 128-bit blocks in the first place: so that this is not an issue. OCB is fine, security-wise. Licensing and patents might be a bigger issue, though, depending on the situation (which is why EAX or GCM are usually preferred).
    – Thomas Pornin
    Commented Jul 7, 2011 at 16:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .