Skip to main content

Module ocb

arcana::cipher

Module ocb 

Source
Expand description

AES-OCB authenticated encryption (OCB3, RFC 7253).

OCB is a single-pass, parallelizable AEAD built on a 128-bit block cipher (here AES-128/192/256, via the existing Aes core). This module implements OCB3 exactly as specified in RFC 7253: the L_*, L_$, L_i doubling in GF(2¹²⁸), the incremental Offset update driven by ntz(i), the Checksum, the PMAC-style associated-data hash HASH, and the Stretch/Nonce bottom rotation for the initial offset.

Encryption returns ciphertext ‖ tag; decryption verifies the tag in constant time and returns the plaintext only on success — a wrong tag never releases plaintext.

Only the standard 16-byte (128-bit) tag and the RFC’s default block cipher (AES) are exposed here. Nonces of 1..=15 bytes are accepted per RFC 7253 §4.2 (TAGLEN is fixed at 128, so the low byte of the nonce-format block is 0).

§Construction (RFC 7253 §4-5)

Setup (once per key, Ocb::new):

  • L_* = ENCIPHER(K, zeros(128))
  • L_$ = double(L_*)
  • L_0 = double(L_$), L_i = double(L_{i-1})

Per message the initial offset comes from the nonce:

  • Nonce = num2str(TAGLEN mod 128, 7) ‖ zeros(120 − 8·|N|) ‖ 1 ‖ N
  • bottom = str2num(Nonce[123..128]) (low 6 bits)
  • Ktop = ENCIPHER(K, Nonce with last 6 bits zeroed)
  • Stretch = Ktop ‖ (Ktop[0..8] xor Ktop[1..9])
  • Offset_0 = Stretch[1+bottom .. 1+bottom+128] (bit offset)

§Side-channel posture

  • Block cipher. OCB calls the existing table-based AES (Aes); AES’s cache-timing gap is the tracked item T1-A, handled separately. This module does not add or fix any AES leakage — it only calls encrypt_block / decrypt_block.
  • Tag verification. Decryption compares the recomputed tag against the received tag with [silentops::ct_eq] — a single data-oblivious pass, no early exit, and no plaintext is returned on mismatch (the decrypted buffer is dropped). A wrong tag leaks nothing through timing.
  • Offset / doubling / checksum / HASH. All are xor, fixed-shift double, and fixed byte moves on public-position data; ntz(i) and all loop bounds depend only on the (public) message and AAD lengths, never on secrets. Constant-time by construction.
  • bottom rotation. The Stretch bit-rotation is indexed by bottom, which is derived from the (public) nonce, not from a secret. No secret-dependent memory access.

§References

Structs§

Ocb
AES-OCB (OCB3, RFC 7253) with a 128-bit tag.