TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

The OCB2 authenticated encryption scheme (ISO standard) has been broken

44 pointsby erwanover 6 years ago

6 comments

tptacekover 6 years ago
The first thing you want to know about this is that OCB3, which supersedes OCB2 and is going on 10 years old now, is not affected by this attack. The IETF RFC for OCB is OCB3.<p>Also, Internet cryptosystems generally don&#x27;t use OCB at all, despite its elegance and performance, because of IPR issues.<p>The second thing you want to know (and you want to know it waaaaaay less than the first thing) is that this breaks authentication, not confidentiality; you can&#x27;t use the attack to directly &quot;decrypt&quot; OCB2 messages, just to forge messages derived from a leaked plaintext&#x2F;ciphertext pair.<p>This is a big deal for crypto people, though; see &#x27;pbsd comment for more.
评论 #18351482 未加载
erwanover 6 years ago
<p><pre><code> We present practical attacks against OCB2 an ISO-standard authenticated encryption (AE) scheme. OCB2 is a highly-efficient blockcipher mode of operation. It has been extensively studied and widely believed to be secure thanks to the provable security proofs. Our attacks allows the adversary to create forgeries with (almost-known) single encryption query. </code></pre> What I find most fascinating is that OCB2 is a scheme for which there has been a security proof since 2003. I am neither a cryptographer nor up-to-date with the state of the art in cryptanalysis, but at first glance, it seems like most attacks discovered these days rely on some kind of side channel or unspecified aspects of the protocol that the implementations get wrong. Even djb (cryp.to) is spooked: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;hashbreaker&#x2F;status&#x2F;1057791485016526848" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;hashbreaker&#x2F;status&#x2F;1057791485016526848</a>
评论 #18351058 未加载
评论 #18350895 未加载
kiwidrewover 6 years ago
So it turns out that the attack &quot;was possible due to the discrepancy between the proof of OCB2 and the actual construction&quot; (according to the paper). That&#x27;s a scary thought.<p>I wanted to learn a little bit more about progress towards verified implementations (i.e. deriving the implementation automatically from its proof) and found a nice summary here:<p><a href="https:&#x2F;&#x2F;crypto.stackexchange.com&#x2F;questions&#x2F;34304&#x2F;formal-verification-in-cryptography&#x2F;34326#34326" rel="nofollow">https:&#x2F;&#x2F;crypto.stackexchange.com&#x2F;questions&#x2F;34304&#x2F;formal-veri...</a>
评论 #18351037 未加载
pbsdover 6 years ago
OCB2 is not a block cipher; it is an authenticated encryption scheme built on top of one.<p>The scary thing here is not so much the error in the proof, which does not have many repercussions beyond OCB2, but that it went 14 years without being discovered. This despite the OCB2 paper, which introduced XEX, being highly influential. Every time something like this happens, confidence on the security of all &quot;provably secure&quot; schemes is undermined.
评论 #18351015 未加载
bcaa7f3a8bbcover 6 years ago
OCB2 is not a cipher, but a mode, like CBC, GCM, XTS, etc.
评论 #18351136 未加载
hkaiover 6 years ago
Where is it used and what is under threat now?
评论 #18350892 未加载
评论 #18350641 未加载