In what paper was OCB2 introduced? I've been working through &quot;Cryptanalysis of OCB2: Attacks on Authenticity and Confidentiality&quot; 1 from earlier this year. My knowledge of OCB2 is pretty shallow though, and so I'm keen to study the scheme in depth before I continue.
From citations and searching around, it seems like OCB2 was introduced in a 2004 paper by Rogaway titled &quot;Efficient instantiations of tweakable blockciphers and refinements to modes OCB and PMAC&quot; 2.
There aren't any explicit mentions of OCB2 in this paper though. Section 10 is titled &quot;The OCB1 Authenticated-Encryption Scheme&quot; and includes a description of &quot;OCB1 with an ideal tweakable blockcipher&quot;. The scheme described in that section matches what I have read about OCB2.
I suppose the scheme only started being called OCB2 after the publication of the paper? Is that correct? If not, where can I find a description of OCB2?
You are correct: OCB2 was only named so after the fact. Confusingly, it was named OCB1 in the original 2004 paper.
You can find the OCB2 naming on the paper that introduces OCB3, The Software Performance of Authenticated-Encryption Modes:

Integrated AE schemes were invented to improve performance of composed
ones, but it has not been clear if they do. In the only comparative
study to date [31], McGrew and Viega found that their composed scheme,
GCM, was about as fast as, and sometimes faster than, the integrated
scheme OCB [35] (hereinafter OCB1, to distinguish it from a subsequent
variant we’ll call OCB2 [34]).

Another instance of the name transitioning is in two papers of Minematsu. The first one, Improved Security Analysis of XEX and LRW Modes at SAC 2006, refers to the mode as the original OCB1; a later paper written in 2008, Generalization and Extension of XEX* Mode, already refers to it as OCB 2.0.
Finally, a patent filed by Rogaway in 2005 refers to the mode as OCB 2.0, which is presumably where the name change happened first.