2
$\begingroup$

I am currently studying OFB mode, and one of the vulnerability mentioned for it is that if two different messages have a block at the same position in the ciphertext, and have same plaintext, the attacker can figure out the encryption function output for that particular block. This was brought up to highlight the danger of reusing IV, so this is assuming that same IV and key are used.

I understand that OFB mode basically encrypts IV repeatedly for each block to generate a block, which gets XORed with the plaintext block to encrypt the text. I do see how knowing plaintext-ciphertext pair can get you the encryption output for that particular block, and can be reused for all blocks that have same IV, key and block position.

What I am having trouble with is understanding how same plaintext at same position can be used to extract encryption output (the book doesn't mention that the plaintext is known, and if it was known, there would be no need to have two different messages). Because both have same position and same IV/key, they will have same output from encryption, and the condition states that same plaintext is used. But OFB is basically about XORing these two to generate the ciphertext, and because inputs are the same, so would the ciphertext for that block. There's no info about plaintext before or after this specified block, so I don't see how this reveals the encryption function output.

$\endgroup$
4
  • $\begingroup$ Which book would that be? $\endgroup$
    – Maarten Bodewes
    Commented Feb 15, 2023 at 15:21
  • $\begingroup$ There is a lot wrong with most if not all of your assumptions. I would strongly suggest to take a look at how the OFB mode operates by studying the encryption (and decryption) functions on Wikipedia $\endgroup$
    – Maarten Bodewes
    Commented Feb 15, 2023 at 15:35
  • $\begingroup$ The book in question is 'Cryptography and Network Security', 6th edition (International), and the page is 220, problem 6.9. It goes as following: "In discussing OFB, it was mentioned that if it was known that two different messages had an identical block of plaintext in the identical position, it is possible to recover the corresponding O_i block." I know, I'm asking for an answer for this problem, but I honestly can't think of how else I could interpret this question without the problem becoming trivial or outright impossible. $\endgroup$
    – Mango
    Commented Feb 16, 2023 at 11:05
  • $\begingroup$ As fgrieu mentioned, that's not entirely correct in the book I'm afraid. $\endgroup$
    – Maarten Bodewes
    Commented Feb 16, 2023 at 14:48

1 Answer 1

2
$\begingroup$

In OFB, with $O_0=\mathrm{IV}$ and plaintext/ciphertext blocks $P_i/C_i$ numbered starting from $1$, we have block cipher encryption output $O_i=E_K(O_{i-1})$ and $C_i=E_i\oplus O_i$.

I am having trouble with is understanding how same plaintext at same position can be used to extract encryption output.

In cryptanalysis, the default is to assume that all ciphertext is known, and it's common to assume that the full plaintext of past messages is known. I assume that until the end of this first section.

Additionally knowing that a new plaintext block $P_i$ is identical to a past plaintext block thus reveals that new plaintext block, and then a XOR of $P_i$ and it's corresponding ciphertext block $C_i$ in the new message gives the encryption output $O_i$ in the new message.

We can similarly determine all $O_j$ for the whole of past messages. If any of these matches $O_i$ and the key $K$ did not change, then we can find $j$ and for which past message, and thus most often $O_{i'}$ for some $i'$ around $i$, since $O_{i'}$ in the new message is $O_{j+i'-i}$ in the old message with the colliding $O_j$. That lets us decipher some of the new message around block $i$ (from block $\max(i-j+1,1)$ to block $\min(\ell-i,m-j)+i$ where the new message has $\ell$ blocks and the message with $O_j$ has $m$ blocks, or something on that tune).

Note: it would be wrong to assume that the possibility of collision among the $O_i$ of various messages becomes sizable past $2^{b/2}$ blocks encrypted with the same key for a $b$-bit cipher (because cycles in iterated random bijections are typically much longer than for iterated random functions). The number of messages encrypted must also be considered. Even though, it's still dangerous to some degree to use the same key to encipher anywhere close to $2^{b/2}$ blocks (or $b\,2^{(b-25)/2}$ bytes if we want probability of collision less than one in a million), even if $\mathrm{IV}$ changes. That's a practical consideration for DES ($b=64$), much less so for AES ($b=128$).


one of the vulnerability mentioned for [OFB] is that if two different messages have a block at the same position in the ciphertext, and have same plaintext, the attacker can figure out the encryption function output for that particular block. This was brought up to highlight the danger of reusing IV, so this is assuming that same IV and key are used.

As pointed above, there is some (moderate) degree of danger even if $\mathrm{IV}$ did change. We are able to confirm that with low probability of false positive if we find two ciphertext blocks identical at the same index, which most likely is because plaintext blocks are identical at the same index, which does happen in practice.

Now assuming $\mathrm{IV}$ did not change across a few messages (regardless of how and even if that is confirmed), and all ciphertext but no known plaintext is available, an attacker stands a fair chance to decipher at least in part a lot of the plaintext, if it's redundant enough (e.g. known to be English in ASCII), much like the One-Time-Pad becomes insecure if the pad gets reused and the plaintext is redundant enough.


Update per comment: The above was written before the source of the problem was known. That problem makes reference to this text in the source, about OFB:

…the sequence of encryption output blocks, $O_i$, depends only on the key and the IV and does not depend on the plaintext. Therefore, for a given key and IV, the stream of output bits used to XOR with the stream of plaintext bits is fixed. If two different messages had an identical block of plaintext in the identical position, then an attacker would be able to determine that portion of the $O_i$ stream.

If we do not assume that the "identical block of plaintext" is somewhat known, that statement is wrong, as well as exercise 6.9 which asks how that determination can be made (it can not).

The only way to make sense of the statement and exercise is if we assume one of the messages is known (which is a common hypothesis, as stated in the first part of my answer). Then the exercise is trivial, but the statement quoted above is at best strange, since it assumes a fixed IV, and we don't need that hypothesis. The only way a fixed IV helps is that it allows recognition (with low probability of false positive) that two different messages have an identical block of plaintext in the identical position.

$\endgroup$
2
  • $\begingroup$ Regarding the direct answer to the question I have asked, the reason why the problem (I have put the quote in the OP comment) mentions "identical block" ultimately is about how the attacker might be able to determine the plaintext of the specified block, is this correct? $\endgroup$
    – Mango
    Commented Feb 16, 2023 at 11:32
  • 2
    $\begingroup$ @Mango: If for some reason you must make sense out of that exercise 6.9, assume that the author assumed one of the plaintext was known. In any case, move along, you understand OFB well enough! $\endgroup$
    – fgrieu
    Commented Feb 16, 2023 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.