Score:2

Can you make an OCB type AEAD using a stream cipher?

hr flag

This is a hypothetical question. Is it possible to use a stream cipher instead of a block cipher for an OCB type single pass AEAD?

The xor of the plaintext blocks for the authentication tag can't work because a change in the ciphertext doesn't change the plaintext enough so maybe the answer is no.

Score:1
my flag

Well, this is hard to answer; a straight-forward insertion of a stream cipher replacing AES doesn't work; however how large of a change can we envision between the resulting modified cipher is no longer "OCB-like"?

a change in the ciphertext doesn't change the plaintext enough so maybe the answer is no

This issue isn't that the size of the change, but the result of the change is predictable (and so the attacker can modify the tag to account for it). In addition, if the attacker makes the same change to two different blocks, the result is no change to the xor, and so it doesn't work to do something secret to the tag after all the plaintext blocks have been xor'ed together.

One obvious approach is not to do a straight-forward xor of the plaintext blocks, but instead something a bit more unpredictable, such as (say) an iterated secret linear operation. However, that starts to make the system look more like GCM (if we restrict the secret linear operation to GF multiplication by a secret element [1]); I don't know if that would be considered 'OCB-like'...

[1]: Yes, I'm aware that GCM processes the ciphertext blocks, not the plaintext blocks...

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.