A weakness in OCB3 used with short nonces allowing for a break of authenticity and confidentiality

OCB3 is a mature and provably secure authenticated encryption mode of operation which allows for associated data (AEAD). This note reports a small flaw in the security proof of OCB3 that may cause a loss of security in practice, even if OCB3 is correctly implemented in a trustworthy and nonce-respecting module. The flaw is present when OCB3 is used with short nonces. It has security implications that are worse than nonce-repetition as confidentiality and authenticity are lost until the key is changed. The flaw is due to an implicit condition in the security proof and to the way OCB3 processes nonces. Different ways to fix the mode are presented.(c) 2023 Elsevier B.V. All rights reserved.

Automated summary

OCB3 is an authenticated encryption mode of operation that allows for associated data (AEAD), and it is known for its maturity and provable security. However, this note highlights a small flaw in the security proof of OCB3 that can result in a loss of security when using short nonces. This flaw has implications worse than nonce-repetition, as it compromises confidentiality and authenticity until the key is changed. Various approaches to fix this flaw in OCB3 are presented.