The OCH Authenticated Encryption Scheme

Sanketh Menda; Mihir Bellare; Viet Tung Hoang; Julia Len; Thomas Ristenpart

Paper 2026/439 Original: eprint.iacr.org/2026/439 ↗

The OCH Authenticated Encryption Scheme

Sanketh Menda

Mihir Bellare

Viet Tung Hoang

Julia Len

Thomas Ristenpart

Abstract

We specify OCH, the first authenticated encryption with associated data scheme built to provide 128-bit multi-user AE security, 128-bit context commitment security, and 256-bit nonces with optional nonce privacy. It therefore addresses pressing limitations of currently widely-deployed schemes. We construct and formally analyze the security of OCH in a modular fashion, with transforms that are of broader applicability. On Intel Raptor Lake CPUs, OCH using the Areion permutation family has a peak encryption speed of 0.62 cycles per byte (cpb), not far off from AES128-GCM (0.38cpb) and outperforming both ChaCha20/Poly1305 (1.63cpb) and TurboSHAKE128-Wrap (3.52cpb).

Metadata

Available format(s): PDF
Category: Secret-key cryptography
Publication info: Preprint.
History: 2026-03-16: last updated; 2026-03-04: published
Short URL: https://ia.cr/2026/439
License: https://creativecommons.org/publicdomain/zero/1.0/

BibTeX

@misc{cryptoeprint:2026/439,
      author = {Sanketh Menda and Mihir Bellare and Viet Tung Hoang and Julia Len and Thomas Ristenpart},
      title = {The OCH Authenticated Encryption Scheme},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/439},
      year = {2026},
      url = {https://eprint.iacr.org/2026/439}
}