OCB2 is not a block cipher; it is an authenticated encryption scheme built on top of one. The scary thing here is not so much the error in the proof, which doe

OCB2 is not a block cipher; it is an authenticated encryption scheme built on top of one. The scary thing here is not so much the error in the proof, which does not have many repercussions beyond OCB2, but that it went 14 years without being discovered. This despite the OCB2 paper, which introduced XEX, being highly influential. Every time something like this happens, confidence on the security of all "provably secure" schemes is undermined.