Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is a rather trivial question, I just want to see if I get the concept right.

In OFB you generate a pseudorandom stream based on some nonce, and you XOR that with the message to get the ciphertext. This sounds a lot like a one-time pad but I don't see the parallelism anywhere in literature. Am I missing something?

share|improve this question
OFB is a synchronous stream cipher, and OTP is one as well. – CodesInChaos Mar 17 '13 at 19:48
up vote 2 down vote accepted

As @CodesInChaos said, OFB is a stream cipher. The one-time pad is a stream cipher, too. One difference is that the one-time pad is information-theoretically secure, while OFB is computationally secure.

share|improve this answer

OFB is a method of converting a block cipher, like AES or DES, into a stream cipher. Because One Time Pad is theoretically secure (though impractical) people often try to make stream ciphers that try to approximate one time pad. OFB is a way of taking a block cipher to try to emulate the security you get from one time pad.

A key distinction is that OTP is only secure if the key is truly random (and some other conditions which are very difficult to satisfy). The OFB produced "keystream" is not truly random, but we hope that it's "good enough" to preclude any attacks against it.

share|improve this answer

An important point for both the one-time pad as well as other (synchronous) stream ciphers is: don't reuse your key stream.

For the one-time pad, the key stream is the key itself, so this means: don't use a key twice. The two-times-pad is broken.

For OFB and other stream ciphers with an initialization vector (IV), the key stream is decided by both key and IV, which means "Don't reuse a key-IV combination twice". For stream ciphers without an initialization vector, it means: Don't use a key twice.

Reusing a key (or key-IV combination) in stream ciphers is often more fatal than non-streamcipher modes of block ciphers, since we have the XOR-property:

$$ C \oplus C' = P \oplus P' $$

(See more details on how to use this in the question Taking advantage of one-time pad key reuse?)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.