A variation of the CBC mode is the Infinite Garble Extension.

I can neither find a block diagram of it, nor the formulas for encryption and decryption. I would really like to learn more about it but there is not much online information available which helps.

What is the main difference between "normal" CBC and the CBC Infinite Garble Extension if I decrypt blocks ?

  • $\begingroup$ The question looks a bit silly now that I have added a link to the paper with the equations; dunno how to best fix this. $\endgroup$
    – fgrieu
    Feb 13, 2017 at 18:52
  • 1
    $\begingroup$ @fgrieu Just leave it be? Seems fine with me. EDIT But the link doesn't work for me. ADDITIONAL EDIT : now it does. $\endgroup$
    – Maarten Bodewes
    Feb 13, 2017 at 18:53
  • $\begingroup$ there is some documentation/information in www.links.org/files/openssl-ige.pdf $\endgroup$ Jan 15, 2018 at 11:33
  • $\begingroup$ the link in the question works via the internet archive web.archive.org/web/20170329121526/http://csrc.nist.gov/groups/… $\endgroup$ Jan 15, 2018 at 11:34

1 Answer 1


The infinite garble extension makes sure that if a ciphertext block is changed that this block and each block after it doesn't decrypt correctly. The way that additional plaintext is affected when the ciphertext is changed is called error propagation. Error propagation over large parts of the plaintext is mainly interesting if you want to combine it with some MDC: Manipulation Detection Code. Then the MDC can be used to verify integrity of the plaintext.

Nowadays we simply encrypt-and-authenticate using CBC + MAC or an authenticated cipher. Error propagation is of little use if you're already verified the ciphertext for integrity and authenticity. Hence you won't find too many mentions of these (computationally intensive) modes of operation; they are mainly used for niche problems where using an authentication tag isn't the right solution.

With most other modes there is a limited amount of error propagation. With CBC and CBF only the same plaintext block and the next plaintext block will not be the original plaintext. With CTR mode only the modified bits are affected; there is no error propagation.

There is also Bi-IGE which does the same, but in two directions: every plaintext block will be changed even if just one bit of ciphertext is changed. So each bit of plaintext is flipped with a 50% possibility (and at least 1 bit with 100% certainty, but that's inconsequential).

More information can be found in my question and the resulting answer about MDC / IGE.

  • $\begingroup$ thanks, thats really interessting. But is there a difference between CBC IGE and the CFB Mode ? If i understood that correctly in the CFB Mode if a ciphertext block is changed that this block and each block after it doesn't encrypt also correctly. $\endgroup$
    – userkir
    Feb 13, 2017 at 19:09
  • $\begingroup$ Where is the difference here ? $\endgroup$
    – userkir
    Feb 13, 2017 at 19:10
  • 5
    $\begingroup$ Actually, with CBC and CFB mode, if you modify a ciphertext block, the decryption of the modified ciphertext has two blocks "wrong"; the rest of the blocks are decrypted correctly. $\endgroup$
    – poncho
    Feb 13, 2017 at 19:42
  • $\begingroup$ Shouldn't it be "doesn't decrypt correctly" in the first paragraph? $\endgroup$
    – vlp
    Jul 21, 2017 at 9:22
  • $\begingroup$ A "manipulation detection code" isn't a MAC? $\endgroup$
    – Melab
    Feb 11, 2018 at 1:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.