Problem - Kevin Tafuro

case, the faster of the two algorithms can be used (though you will get incompatible
results if you use decryption where someone else uses encryption).
We believe that the advantages of CWC mode make it more appealing for generalpurpose
use than all other modes. However, the problem of repeating nonces is a
serious one that developers often get wrong. See Recipe 5.10, where we provide a
high-level wrapper to CWC mode that is designed to circumvent such problems.
Offset Codebook (OCB) mode
OCB mode is a patented encryption mode that you must license to use. * CWC offers
similar properties and is not restricted by patents.
OCB is reasonably new. It was introduced by Phil Rogaway and is based on earlier
work at IBM. Both parties have patents covering this work, and a patent held by the
University of Maryland also may apply. OCB is not under consideration by any standards
movements.
The primary disadvantages of OCB mode are:
• It is restricted by patents.
• The required nonce must never be reused (this is easy to avoid).
• It isn’t well suited for use with 64-bit block ciphers. It does work well with AES,
of course.
The primary advantages of OCB mode are:
• OCB ensures message integrity in addition to performing encryption.
• The additional functionality requires minimal message expansion (you would
need to send the same amount of data to perform integrity checking with any of
the previously mentioned cipher modes).
• OCB is fully parallelizable (hardware implementations can achieve speeds above
10 gigabits per second).
• OCB has provable security properties while using only a single block cipher key.
This means that under reasonable assumptions on the underlying block cipher,
the mode provides excellent secrecy and message integrity if the nonce is always
unique.
• Messages can be of arbitrary length (there is no need for block alignment).
• For ciphers where raw encryption and decryption operations require separate
algorithms (particularly AES), only a single algorithm is necessary. In such a
case, the faster of the two algorithms can be used (though you will get incompatible
results if you use decryption where someone else uses encryption).
* At least one other patent also needs to be licensed to use this mode legally.
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Selecting a Cipher Mode | 169