Paper 2019/311

Cryptanalysis of OCB2: Attacks on Authenticity and Confidentiality

Akiko Inoue, Tetsu Iwata, Kazuhiko Minematsu, and Bertram Poettering


We present practical attacks on OCB2. This mode of operation of a blockcipher was designed with the aim to provide particularly efficient and provably-secure authenticated encryption services, and since its proposal about 15 years ago it belongs to the top performers in this realm. OCB2 was included in an ISO standard in 2009. An internal building block of OCB2 is the tweakable blockcipher obtained by operating a regular blockcipher in XEX$^\ast$ mode. The latter provides security only when evaluated in accordance with certain technical restrictions that, as we note, are not always respected by OCB2. This leads to devastating attacks against OCB2's security promises: We develop a range of very practical attacks that, amongst others, demonstrate universal forgeries and full plaintext recovery. We complete our report with proposals for (provably) repairing OCB2. To our understanding, as a direct consequence of our findings, OCB2 is currently in a process of removal from ISO standards. Our attacks do not apply to OCB1 and OCB3, and our privacy attacks on OCB2 require an active adversary.

Note: This report is an edited amalgamation of three eprint reports by different groups of authors that appeared in Autumn 2018 in reports 2018/1040, 2018/1087, and 2018/1090. An extended abstract appears in the proceedings of CRYPTO 2019 and is available via DOI 10.1007/978-3-030-26948-7_1 from the Springer website.

Available format(s)
Secret-key cryptography
Publication info
Published by the IACR in JOC 2020
OCB2Authenticated EncryptionCryptanalysisForgeryPlaintext RecoveryXEX
Contact author(s)
a_inoue @ nec com
tetsu iwata @ nagoya-u jp
k-minematsu @ nec com
poe @ zurich ibm com
2020-05-25: last of 3 revisions
2019-03-20: received
See all versions
Short URL
Creative Commons Attribution


      author = {Akiko Inoue and Tetsu Iwata and Kazuhiko Minematsu and Bertram Poettering},
      title = {Cryptanalysis of OCB2: Attacks on Authenticity and Confidentiality},
      howpublished = {Cryptology ePrint Archive, Paper 2019/311},
      year = {2019},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.