Efail: Outdated Crypto Standards Are to Blame

> OCB has some nice properties, but it’s patented.

I think that’s understating matters a bit. OCB is great, wonderful, better than GCM, and you should always use it — but it’s patented. Fortunately, open-source software is allowed to use it, which is great.

If you're trying to write proprietary software, then you’re allowed to use it for free unless you’re writing military-use software.

If Rogaway had just opened it to everyone for any use, I’m pretty sure noöne would be using GCM.