Paper 2026/439

The OCH Authenticated Encryption Scheme

Mihir Bellare, University of California, San Diego

Viet Tung Hoang, Florida State University

Julia Len, UNC Chapel Hill

Thomas Ristenpart, University of Toronto

Abstract

We specify OCH, the first authenticated encryption with associated data scheme built to provide 128-bit multi-user AE security, 128-bit context commitment security, and 256-bit nonces with optional nonce privacy. It therefore addresses pressing limitations of currently widely-deployed schemes. We construct and formally analyze the security of OCH in a modular fashion, with transforms that are of broader applicability. On Intel Raptor Lake CPUs, OCH using the Areion permutation family has a peak encryption speed of 0.62 cycles per byte (cpb), not far off from AES128-GCM (0.38cpb) and outperforming both ChaCha20/Poly1305 (1.63cpb) and TurboSHAKE128-Wrap (3.52cpb).

Note: Update includes some minor corrections to typos, including a constant in Theorem 3.

@misc{cryptoeprint:2026/439,
      author = {Sanketh Menda and Mihir Bellare and Viet Tung Hoang and Julia Len and Thomas Ristenpart},
      title = {The {OCH} Authenticated Encryption Scheme},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/439},
      year = {2026},
      url = {https://eprint.iacr.org/2026/439}
}