Which attacks can be avoided by the use of OFB instead of ECB?

For a file encryption program, I was told to use Output Feedback mode (OFB) instead of ECB (Electronic code book) mode.

Which attacks can I avoid by this choice?

-
What do you mean "other"? Are you contrasting this with CFB mode? Can you elaborate on what attacks you're thinking about? –  B-Con May 3 '12 at 18:02
When you are considering using a particular mode, it is generally useful to ponder what security properties you need from the mode, and whether that mode provides those properties. What security properties are you looking for? –  poncho May 3 '12 at 19:46
security for encrypted message and encrypted file. –  goldroger May 4 '12 at 0:27
@JohnPaulParreño: I edited your question to be valid English, and still ask what you wanted to ask (I hope) ... sorry, I should have done this before, but I somehow missed your question. Please check that this is actually what you want to ask, and feel free to edit again. –  Paŭlo Ebermann Jun 5 '12 at 18:16
that's okay, It's more understandable now. –  goldroger Jun 5 '12 at 18:22

OFB is a mode of operation to ensure confidentiality of messages a) longer than the block size of the encryption algorithm, and b) that can be re-broadcast. The motivation for these kinds of modes it to avoid the weaknesses that come from using plain ECB mode.

To be precise, the typical attack on ECB mode involves analyzing the ciphertext and looking for repeated blocks. Repeated ciphertext blocks mean repeated plaintext blocks, and knowing about repeated plaintext can help the attacker analyze the captured ciphertext. (Meaning that ECB is not semantically secure.) In some cases, this is enough for the attacker to learn all, or almost all, of the plaintext. OFB mode prevents this from happening by using randomized encryption to ensure that repeated plaintext within the message does not cause repeated ciphertext.

OFB is resistant to ciphertext errors in that if the ciphertext has bits modified in error, only the bits of the plaintext that directly correspond to the ciphertext are modified.

Because it OFB mode works like a stream cipher, it has the typical weakness that allows known plaintext to be easily modified by an attacker. (Ie, if OFB mode produces a keystream $K$, then the ciphertext $C$ is defined as $C_i := P_i \oplus K_i$, so if $P_i$ is known to the attacker then so is $K_i$, so they can create a new ciphertext $C'_i := P'_i \oplus K_i$ where $P'_i := P_i \oplus X$ and $X$ is a value chosen to produce the desired modified plaintext $P'_i$.) But since message confidentiality (the goal of OFB) does not encompass message integrity, this is not necessarily a big deal.

-

ECB mode is a deterministic encryption, instead in OFB if the initial vector is random choosed (and of course published with the cryptogram) is a random encryption. What's the matter with det.enc.? The problem is that if you encoded two time the same message you are going to get two time the same chipertext, so the adversary can understand that you said the same thing twice and she learned something!

-