Which attacks can be avoided by the use of OFB instead of ECB?

Question

For a file encryption program, I was told to use Output Feedback mode (OFB) instead of ECB (Electronic code book) mode.

Which attacks can I avoid by this choice?

Answer 1

OFB is a mode of operation to ensure confidentiality of messages a) longer than the block size of the encryption algorithm, and b) that can be re-broadcast. The motivation for these kinds of modes it to avoid the weaknesses that come from using plain ECB mode.

To be precise, the typical attack on ECB mode involves analyzing the ciphertext and looking for repeated blocks. Repeated ciphertext blocks mean repeated plaintext blocks, and knowing about repeated plaintext can help the attacker analyze the captured ciphertext. (Meaning that ECB is not semantically secure.) In some cases, this is enough for the attacker to learn all, or almost all, of the plaintext. OFB mode prevents this from happening by using randomized encryption to ensure that repeated plaintext within the message does not cause repeated ciphertext.

OFB is resistant to ciphertext errors in that if the ciphertext has bits modified in error, only the bits of the plaintext that directly correspond to the ciphertext are modified.

Because it OFB mode works like a stream cipher, it has the typical weakness that allows known plaintext to be easily modified by an attacker. (Ie, if OFB mode produces a keystream $K$, then the ciphertext $C$ is defined as $C_i := P_i \oplus K_i$, so if $P_i$ is known to the attacker then so is $K_i$, so they can create a new ciphertext $C'_i := P'_i \oplus K_i$ where $P'_i := P_i \oplus X$ and $X$ is a value chosen to produce the desired modified plaintext $P'_i$.) But since message confidentiality (the goal of OFB) does not encompass message integrity, this is not necessarily a big deal.

Answer 2

Wikipedia has an excellent visual demonstration of the insecurity of ECB mode when applied to (potentially) repetitive data:

Here, the first picture on the left shows a simple cartoon image (Tux the Penguin). The second image is the same, but with the (raw, uncompressed RGB) image data encrypted using ECB mode. While details of the image are scrambled, the outline is still clearly visible because identical input blocks (found mainly in the areas with solid color) produce identical output in ECB mode. The third image shows the result of the same encryption process using a different mode that lacks this weakness, such as CBC, CFB, OFB or CTR.

Of course, if one used ECB mode to encrypt a compressed image, or some other data that lacks such obvious redundancies, then the patterns in the output would not be so obvious either. Still, many real-world files do contain redundancies — if they didn't, compression programs would be useless — and it's hard to be sure that those cannot be used by an attacker to compromise ECB mode encryption.

(To make the other modes secure even if the same key is used for more than one message, one also needs to include a suitable random IV or nonce. Presumably, the IV has been omitted from the example output here to make it match the length of the input.)

Answer 3

ECB mode is a deterministic encryption, instead in OFB if the initial vector is random choosed (and of course published with the cryptogram) is a random encryption. What's the matter with det.enc.? The problem is that if you encoded two time the same message you are going to get two time the same chipertext, so the adversary can understand that you said the same thing twice and she learned something!