A weakness in OCB3 used with short nonces allowing for a break of authenticity and confidentiality

ePrint Report: A weakness in OCB3 used with short nonces allowing for a break of authenticity and confidentiality

Jean Liénardy, Frédéric Lafitte

OCB3 is a mature and provably secure authenticated encryption mode of operation which allows for associated data (AEAD).
This note reports a small flaw in the security proof of OCB3 that may cause a loss of security in practice, even if OCB3 is correctly implemented in a trustworthy and nonce-respecting module.
The flaw is present when OCB3 is …

aead confidentiality data encryption eprint report flaw loss may mode practice report reports security weakness