Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:81584
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.175 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAMU2iguFkC-SHvOoQG1rRUzJ-X4+3zudW1tVacnF+UoJqoVz+w@mail.gmail.com>
References: <CAPwsocHXO4A+XH+-8uZJdJBBGW1wNrtneQ7ukbukKFoOXmVEtA@mail.gmail.com>
	<CAMU2igs_2itLWZsZBtGPBfT1Kj29fJyn4Tnmj_RLXn2TpOaZwg@mail.gmail.com>
	<CAPwsocFkbY75nUROFvFbO+YOoN4u9sa09ot8o_TrQOdp09r6_g@mail.gmail.com>
	<CAEKnhAGHmMCiHaQkDDdG5ukiJhB7it8KZGAF0Q-JuTd-udZtkg@mail.gmail.com>
	<CAPwsocHFweJhves+tU66GVKPjcO5kzFGZvzaaMg9cjCYJsgL1Q@mail.gmail.com>
	<CAPwsocG-4vfT4PbC_0BG3QFzi0Ws-1anVCT-qynErnsj_pUG7w@mail.gmail.com>
	<CAMU2iguFkC-SHvOoQG1rRUzJ-X4+3zudW1tVacnF+UoJqoVz+w@mail.gmail.com>
Date: Mon, 2 Feb 2015 12:03:47 +0000
Message-ID: <CAPwsocGFc82pviq3i0jwerVmi3k6r9sfT3wLCDKZEcBPDHvd+w@mail.gmail.com>
To: Jason Gerfen <jason.gerfen@gmail.com>
Cc: Jakub Zelenka <bukka@php.net>, PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] OpenSSL ext. improvements for authenticated cipher modes.
From: leight@gmail.com (Leigh)

On 2 February 2015 at 11:46, Jason Gerfen <jason.gerfen@gmail.com> wrote:
> According to documentation provided about the OCB mode of AES it says the
> following:
>
> Section 3: The scheme
>>
>> The tag length is an integer =CF=84 =E2=88=88 [0 .. n]. ... As for the t=
ag length, a
>> suggested default of =CF=84 =3D 64 is reasonable. Tags of 32 bits are st=
andard in
>> retail banking. Tags of 96 bits are used in IPSec. Using a tag of more t=
han
>> 80 bits adds questionable security benefit, though it does lengthen each
>> cipher text.

In Rogaway's own OCB FAQ it states:

The number =CF=84, the tag length of the scheme, is, like the blockcipher
E, a parameter of the mode. It=E2=80=99s a number 0 =E2=89=A4 =CF=84 =E2=89=
=A4 128.

http://web.cs.ucdavis.edu/~rogaway/ocb/ocb-faq.htm

> The GCM mode is somewhat different regarding the allowed tag length(s).
>
> Section 5.2.1.2 Output Data
>>
>> The bit length of the tag, denoted t, is a security parameter, as
>> discussed in Appendix B. In general, t may be any one of the following f=
ive
>> values: 128, 120, 112, 104, or 96. For certain applications, t may  be 6=
4 or
>> 32; guidance for the use of these two tag lengths, including requirement=
s on
>> the length of the input data and the lifetime of the key in these cases,=
 is
>> given in Appendix C.

So in both of these cases the largest tag size is 128 bits
(corresponds to the length of 16 that I mentioned - bits -> bytes). A
tag length of 16 is a safe assumption if we don't want to allow the
user to specify, however it could prevent interop with other
applications, if they require a tag of a different length.