I know that when you use a stream cipher you are just XOR'ing the plain text with the PRNG stream, such that you know if a specific byte is in position 3 of the plain text it will still be in position 3 of the cipher text. I know that this is not true for block ciphers in ECB/CBC/other modes except OFB. But why? What is happening behind the scenes?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
It is because the cipher is designed with the avalanche effect property. Namely, changing a single bit in the plaintext (or key) should result in a significant change in the ciphertext. So really, it happens because ciphers are designed with that property.
Really it is the entire cipher. If you look at a cipher generically as substitutions and permutations, it is the substitutions which really cause the effect, but even then, the permutations contribute to it when multiple rounds are used.
They're just two different ways of encrypting data. In the first case, you use a block cipher which will "mix" an input to produce an output, in such a way that every bit in the output depends on every bit in the input. This output cannot be traced back to the input without knowledge of the key. You could view it as bits being thrown around and flipped pseudorandomly depending on the value of the key.
On the other hand, stream ciphers (or block ciphers in a stream cipher mode of operation, such as OFB, CFB, CTR, etc..) generate a pseudorandom keystream from the original key (this keystream is independent of the message being encrypted), and use that to "mask" the plaintext to produce the ciphertext and vice versa, so plaintext bits do not actually move (in general) but are just either flipped or left alone, but this does not make any difference in security if the cipher is good enough*
Both are equally good ways of encrypting data provided the underlying cipher is strong. They both have their pros and cons (block encryption requires padding, whereas stream ciphers don't, however stream ciphers are more susceptible to key-related weaknesses, for instance)
*it is possible to abuse this by guessing the plaintext at a given point, say the plaintext is "deposit 10000 dollars to my account", the attacker could guess the location of the "1" and change it such that after decryption the message becomes "deposit 90000 dollars to my account", unnoticed, whereas in a block cipher mode doing this would result in a garbled output because of how block encryption works. However any encryption worth its salt also guarantees integrity via a hash function or other so in practice this is never a concern.