OCB; A BlockCipher Mode of Operation for Efficient Authenticated Encryption

We describe a parallelizable block-cipher mode of operation that simultaneously provides ∗privacy and authenticity. OCB encrypts-and-authenticates a nonempty string M ∈ {0, 1} using I|M |/nl + 2 block-cipher invocations, where n is the block length of the underlying block cipher. Additional overhead is small. OCB refines a scheme, IAPM, suggested by Jutla [20]. Desirable properties of OCB include: the ability to encrypt a bit string of arbitrary length into a ciphertext of minimal length; cheap offset calculations; cheap session setup, a single underlying cryptographic key; no extended-precision addition; a nearly optimal number of block-cipher calls; and no requirement for a random IV. We prove OCB secure, quantifying the adversary’s ability to violate privacy or authenticity in terms of the quality of the block cipher as a pseudorandom permutation (PRP) or as a strong PRP, respectively