ocb3: restrict minimum NonceSize to U6
#593
Conversation
Based on the recommendations of the following paper, which describes an attack against OCB3 mode: https://eprint.iacr.org/2023/326.pdf > In the case of OCB3, it is easy to fix the algorithm’s specification > in order to avoid the weakness and abide to the full assumptions of > the security proof. If the description is unchanged, the requirement > N ≥ 6 must become an absolute requirement. Furthermore, this restricts the minimum tag size to 1-byte, up from the former 0-bytes. This is a questionable choice of minimum but reflects the wording in the RFC: > The TAGLEN parameter specifies the length of authentication tag used > by OCB and may be any value up to 128
| TagSize: ArrayLength<u8> + IsLessOrEqual<U16>, | ||
| NonceSize: ArrayLength<u8> + IsLessOrEqual<U15>, | ||
| TagSize: ArrayLength<u8> + IsGreater<U0> + IsLessOrEqual<U16>, | ||
| NonceSize: ArrayLength<u8> + IsGreaterOrEqual<U6> + IsLessOrEqual<U15>, |
There was a problem hiding this comment.
I think you also need to add bounds like GrEq<NonceSize, U6>: NonZero,, otherwise it will have no effect. Same with IslessOrEqual. IIRC the current bounds only state that you can compare against the number and nothing about comparison result.
Plus it's worth to add compilation failure tests for unsupported sizes.
There was a problem hiding this comment.
What's an example case where that bound is required?
There was a problem hiding this comment.
IIUC with the current bound you still can use U5 for NonceSize, same for U16.
There was a problem hiding this comment.
It may be worth to add sealed TagSizes/NonceSizes traits to simplify public bounds.
There was a problem hiding this comment.
I can prepare a quick PR to amend this.
There was a problem hiding this comment.
We had those before although removed them in #590, though the requirements have gotten more complex since then. Still, it's a bounded range, and if we can express it properly with typenum it will be easier to eventually move to const generics.
Based on the recommendations of the following paper, which describes an attack against OCB3 mode:
https://eprint.iacr.org/2023/326.pdf
Furthermore, this restricts the minimum tag size to 1-byte, up from the former 0-bytes. This is a questionable choice of minimum but reflects the wording in the RFC:
Closes #592