A Weakness in OCB3 Used with Short Nonces Allowing for a Break of Authenticity and Confidentiality

May 24, 2026

Upload by Jiven

OCB3 is a mature, provably secure authenticated encryption mode that supports associated data (AEAD). This note reports a small flaw in OCB3’s security proof that can translate into real-world loss of security even with correct implementation inside a trustworthy, nonce-respecting module. The weakness occurs when OCB3 uses short nonces. Its impact can be worse than nonce repetition: confidentiality and authenticity fail until the key is changed. The root cause is an implicit proof condition and how OCB3 processes the nonce; multiple fixes are proposed.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages8

Reading Time20 min

Introduction

Authenticated encryption and AEAD

OCB generations and standardization

Description of OCB3

Notation and input/output

Encryption algorithm steps

FAQs

How bad is the impact compared with nonce repetition?

The security implications are described as worse than nonce repetition: confidentiality and authenticity are lost until the key is changed, and the note shows that a single query can suffice with high success probability.

May 24, 2026

Upload by Jiven