5 ms·
I laughed when I read that GCM is hard for library authors. I remember trying to implement GCM but failing, so I decided to transcribe a "simple implementation"
by bjoli 4y ago
I laughed when I read that GCM is hard for library authors. I remember trying to implement GCM but failing, so I decided to transcribe a "simple implementation" but failed at that also.
Then I decided to try OCB mode and it worked on the first try.
By the way, isn't OCB unpatented as of recently?
- retrocryptid 4y agoI hadn't heard about OBC being unpatented, but then the Wikipedia pointed me to this email to the ietf cryptography forum: https://mailarchive.ietf.org/arch/msg/cfrg/qLTveWOdTJcLn4HP3ev-vrj05Vg/ https://mailarchive.ietf.org/arch/msg/cfrg/qLTveWOdTJcLn4HP3... So... yes... it looks like OCB is no longer encumbered. I am curious why GCM was hard. Hard to do without side-channel leaks I can understand, but 800-38D seemed straight-forward.
- bjoli 4y agoI have no mathematical background at all (I am an orchestra musician), and I did get it to mostly work. It was just that it didn't work for some inputs, and I could never figure out why despite having access to a proper debugger and a good repl (in scheme). OCB was a breeze in comparison. Caveat: I never understood the birthday attack from Ferguson on OCB and why it doesn't work on GCM, so I am really not the right person to make any recommendations
- zimmerfrei 4y agoA GCM software implementation can be simple, fast, or secure against side-channel attacks: you can only pick two. OCB (RFC7253) is indeed much simpler and it really deserves more popularity.
- rainsford 4y agoI think it would have been far more popular if Rogaway hadn't kept it patented well beyond the point where it was clear patented crypto had no future. It's a pretty neat solution to the problem and the continued insistence on restricting its usage with a patent is one of the more baffling things I've seen in the crypto world.