Problem - Kevin Tafuro

Because of its patent status and the availability of free alternatives with essentially
identical properties (particularly CWC mode), we recommend against using OCB
mode. If you’re interested in using it anyway, see Phil Rogaway’s OCB page at http://
www.cs.ucdavis.edu/~rogaway/ocb/.
CTR plus CBC-MAC (CCM) mode
While OCB mode has appealing properties, its patent status makes it all but useless
for most applications. CCM is another alternative that provides many of the same
properties, without any patent encumbrance. There are some disadvantages of CCM
mode, however:
• While encryption and decryption can be parallelized, the message integrity check
cannot be. OCB and CWC both avoid this limitation.
• In some applications, CCM can be nonoptimal because the length of the message
must be known before processing can begin.
• The required nonce must never be reused (this is easy to avoid).
• It isn’t well suited to 64-bit block ciphers. It does work well with AES, of course.
CCM is also fairly new (more recent than OCB, but a bit older than CWC). It was
introduced by Doug Whiting, Russ Housley, and Niels Fergusen. NIST is currently
considering it for standardization.
The primary advantages of CCM mode are:
• CCM ensures message integrity in addition to performing encryption.
• The message integrity functionality requires minimal message expansion (you
would need to send the same amount of data to perform integrity checking with
any of the previously mentioned cipher modes).
• CCM has provable security properties while using only a single key. This means
that under reasonable assumptions on the underlying block cipher, the mode
provides near-optimal secrecy and message integrity if the required nonce is
always unique.
• CCM leverages most of the good properties of CTR mode, such as being able to
handle messages without padding and being slow to leak information.
• For ciphers where raw encryption and decryption operations require separate
algorithms (particularly AES), only a single algorithm is necessary. In such a
case, the faster of the two algorithms can be used (though you will get incompatible
results if you use decryption where someone else uses encryption).
In this book, we focus on CWC mode instead of CCM mode because CWC mode
offers additional advantages, even though in many environments those advantages
are minor. However, if you wish to use CCM mode, we recommend that you grab an
off-the-shelf implementation of it because the mode is somewhat complex in com-
170 | Chapter 5: Symmetric Encryption
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.