3
$\begingroup$

I just stumbled across a Stack Overflow post which points out that the libmcrypt library (notably used in PHP) implements a somewhat unusual set of block cipher modes: it calls the usual CFB and OFB modes, with full-block feedback, "nCFB" and "nOFB" respectively, and implements the CFB-8 mode as just "CFB".

Besides the somewhat unconventional (and potentially confusing) naming convention, there's nothing novel there. However, it turns out that libmcrypt also features an 8-bit shift register variant of OFB mode, called simply "OFB", which is described rather curiously in the documentation:

"OFB: The Output-Feedback Mode (in 8bit). This is a synchronous stream cipher implemented from a block cipher. It is intended for use in noisy lines, because corrupted ciphertext blocks do not corrupt the plaintext blocks that follow. Insecure (because used in 8bit mode) so it is recommended not to use it. Added just for completeness."

Ignoring the weirdness of a library supporting an encryption mode that its own developers describe as "insecure" and recommend "not to use it", I started wondering — is it really insecure?

It's well known that OFB mode keystream generation is equivalent to encrypting an all-zero message in CFB mode. Thus, if CFB-8 mode is IND-CPA secure (and it is, at least when used with a random IV), so that, in particular, the encryption of an all-zero message cannot be distinguished from a random bitstring, then neither can the XOR of this ciphertext with an arbitrary message. Doesn't that imply that this "OFB-8" mode is IND-CPA secure, too?

Improve this question
$\endgroup$
1
  • $\begingroup$ Ignoring the weirdness of a library supporting an encryption mode that its own developers describe as "insecure" and recommend "not to use it" -- what's so strange about that? You can include it for completeness and - more importantly - backwards compatibility. Kudos to the developers to mention that it shouldn't be used. Same goes for 8 bit CFB mode of course, if just for reasons of efficiency. $\endgroup$
    – Maarten Bodewes ♦
    Commented Apr 18, 2015 at 14:16

1 Answer 1

Reset to default
2
$\begingroup$

Actually, I think I found the answer to my question while writing it, but I'll post it anyway, since it might be interesting to others:

Yes, OFB mode is secure even with 8-bit feedback, at least as long as IVs are chosen randomly.

Specifically, in the paper "New proof for old modes" (IACR Cryptology ePrint Archive, 2008), which I've cited earlier here, Mark Wooding proves the IND-CPA security (and, in fact, a somewhat stronger security property termed ROG-CPA, for "real or garbage" indistinguishability) of both CFB-$n$ and OFB-$n$ modes for any number of feedback bits $n$, provided that either:

  1. the IVs are chosen randomly,
  2. the IVs are generated by encrypting a deterministic sequence (a "generalized counter") using the block cipher, or
  3. the IVs are directly chosen according to a deterministic sequence, and $n$ is no less than the block size of the block cipher used.

(The extra limitation on the feedback size $n$ in the case of a deterministic IV sequence is due to that fact that CFB and OFB modes using less than one cipher block of feedback have some rare "weak IVs" that can produce a low-period keystream. Presumably, a deterministic IV sequence chosen to deliberately avoid such IVs would also be safe.)

Improve this answer
$\endgroup$
3
  • $\begingroup$ The problem with that paper is that I cannot find any references to it, nor any notions of peer review. The author talks of "we" but I see only one author mentioned. It doesn't seem to be published by a major institution either. I'm not saying that the paper is incorrect in any way but I would not accept all the conclusions without another good look. If you have any pointers to peer reviews please include them! $\endgroup$
    – Maarten Bodewes ♦
    Commented Apr 18, 2015 at 14:31
  • $\begingroup$ www.distorted.org.uk just returns It works!. On the good side, IACR is reputable, the paper doesn't look anything like snake oil and he seems to have worked with Philip Rogaway. $\endgroup$
    – Maarten Bodewes ♦
    Commented Apr 18, 2015 at 14:42
  • $\begingroup$ That's a good point, and I'd be grateful for any references to actual peer-reviewed articles proving (or disproving!) this claim. As far as I can tell myself, the proofs by Wooding do look reasonable at a glance, but I must admit that I didn't go over them in full detail, and they do involve a bunch of subtle details and corner cases one could easily stub one's toe against. Hence why I haven't accepted my own answer yet. $\endgroup$
    – Ilmari Karonen
    Commented Apr 18, 2015 at 20:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.