Module ocb2 

OCB2-AES128 as implemented by Mumble, including its mitigations against the attack in https://eprint.iacr.org/2019/311 (section 9 / XEX* forgery).

Ported from the vendored reference (R1); every routine mirrors its C++ source:

REF: references/vendored/ocb2-vectors/CryptStateOCB2.cpp : ocb_encrypt, ocb_decrypt, encrypt, decrypt, S2, S3, XOR. REF: references/vendored/ocb2-vectors/TestCrypt.cpp : the golden vectors and mitigation tests reproduced in this module’s tests.

The block “doubling” (S2) and “tripling” (S3) treat the 16-byte block as a big-endian 128-bit element of GF(2^128) with reduction polynomial 0x87; the reference’s endianness dance (SWAPPED) is just that operation, written here portably in terms of bytes.

Structs

CryptState

A full OCB2 crypt state for one direction pair: the AES key, both IVs, the replay history and the good/late/lost counters. Mirrors Mumble’s CryptStateOCB2 object (minus key generation, which belongs to session setup).

Constants

BLOCK_SIZE

AES-128 block size in bytes.

KEY_SIZE

AES-128 key size in bytes.

Functions

ocb_decrypt

OCB2 decryption of encrypted under cipher with the given nonce.

ocb_encrypt

OCB2 encryption of plain under cipher with the given nonce.