On the Quantum Security of OCB

The OCB mode of operation for block ciphers has three variants, OCB1, OCB2 and OCB3. OCB1 OCB3 can be used as secure authenticated encryption schemes whereas been shown to classically insecure (Inoue et al., Crypto 2019). Even further, in the presence quantum queries functionality, a series works by Kaplan al. (Crypto 2016), Bhaumik (Asiacrypt 2021) Bonnetain have how break unforgeability modes. However, these did not consider confidentiality queries.We fill this gap presenting first formal analysis IND-qCPA security OCB. In particular, we show attacks breaking Surprisingly, are able prove that is when without associated data, while relying on assumption underlying cipher quantum-secure pseudorandom permutation. Additionally, present new universal Our implications post-quantum XTS, well-known disk standard, was considered but mostly left open Anand (PQCrypto 2016).