aes-ocb

[awgcooper]

Is Borg2 using OCB3? Also, how often does rekeying occur?

(I haven't suddenly become a crypto expert but a friend who is asked me these questions).

[infectormp]

Your friend can read the docs and then ask a more detailed question
https://borgbackup.readthedocs.io/en/master/internals/data-structures.html#aead-modes

[ThomasWaldmann]

borg2 just uses AES-OCB from openssl, not sure what version that is.

At the start of each backup session (e.g. borg create command), borg derives fresh AES session keys from the borg key material. IIRC, it does not re-key within the session.

Your friend could have a look at #6501, there is some related discussion.

[ThomasWaldmann]

From Wikipedia:
"""
OCB2 was first published in 2003, originally named authenticated-encryption mode, or advanced encryption mode (AEM) and was shown to be completely insecure in 2019.

OCB3, published in 2011, changes again the way offsets are computed and introduces minor performance improvements.
"""
So guess we can assume OpenSSL uses OCB3, since that is out since long!?

[awgcooper]

Exactly, it's because of the flaw in OCB2 that I was asking but I think it's safe to assume that OpenSSL will have reacted accordingly!

Regarding re-keying: apparently with OCB one needs to rekey after encrypting about 2^48 blocks which is ~ 4 PBs. I think we can assume that no one is creating petabye-size archives (yet) so the session keys derived at the begining of a backup job will suffice.

[ThomasWaldmann]

They have it since openssl 1.1.0, which is from Aug 2016, but they don't tell details in the change log.
But considering that is 5 years after OCB3 came out, guess it is that.

[awgcooper]

Even if they implemented OCB2 in Aug 2016, it would be seriously strange if they hadn't replaced it after the vulnerability was discovered. I shouldn't advocate "trust DON'T verify" but it hardly seems worth asking about, right?!

[ThomasWaldmann]

What's kind of a "documentation bug" is that neither the change log nor the docs mention OCB3.

[awgcooper]

Agreed.