How many cycles are there in a CFB mode of operation?

Say for example I use AES encryption in CFB mode. How many times will this cycle before outputting the final ciphertext? In the picture below this is done in 3 cycles. Are there any rules on the amount of cycles before outputting the final ciphertext? I may be way off but it's a bit confusing with this specific mode of operation. Example


2 Answers 2


You seem to be reading the diagram wrong. There are no "cycles" in CFB mode, and each block of plaintext/ciphertext is encrypted only once.

Admittedly, it's not entirely your fault: the diagram confusingly uses the same "Plaintext" and "Ciphertext" labels for each block, even thought they're actually not the same.

So, what actually happens in CFB mode encryption is that the plaintext message is divided into blocks of some fixed length (which typically matches the block size of the block cipher being used). Each of these plaintext blocks is then XORed with the output of the block cipher, and the result of this XOR operation is output as the corresponding ciphertext block, and also used as the input to the block cipher for encrypting the next plaintext block.

(Most of the other classical block cipher modes of operation work in a similar way, only the details differ. For example, in OFB mode the output of the block cipher is saved for use as input to the next block cipher call before it is XORed with the current plaintext block to produce the corresponding ciphertext block.)

Mathematically, you can write CFB mode encryption like this:

$$C_i = P_i \oplus E_K(C_{i-1})$$

where $P_i$ is the $i$-th plaintext block in the message, $C_i$ is the corresponding $i$-th ciphertext block, and $C_{i-1}$ is the previous ciphertext block.* Also, $\oplus$ denotes bitwise XOR and $E_K$ denotes block cipher encryption with the key $K$.

*) For the first block, where $C_{i-1}$ is not defined, we use the IV instead.

  • $\begingroup$ Thanks for a great explanation. So say I've got 4 blocks of data(512 bits), will the second block of ciphertext output be appended to the first one or is it the final ciphertext output that is the result of this whole process of encrypting using AES and CFB mode? $\endgroup$
    – user48297
    May 28, 2017 at 17:16
  • $\begingroup$ Yes, if you have 4 blocks of plaintext input, then you will receive (at least) 4 blocks of ciphertext output. That's true of any general-purpose encryption scheme, anyway. $\endgroup$ May 28, 2017 at 17:19
  • $\begingroup$ At least? What do you mean by that? $\endgroup$
    – user48297
    May 28, 2017 at 17:44
  • $\begingroup$ Some encryption modes can produce ciphertext that is longer than the plaintext, for various reasons. Even CFB mode sort of does, if you include the IV in the encrypted message. (Sometimes you don't need to, e.g. if the protocol you're using to send the messages already provides a unique message ID that can be used to derive the CFB IV.) $\endgroup$ May 28, 2017 at 17:48

In CFB-mode you effectively have a data-dependent stream cipher and you'll need $\lceil\frac{l}n\rceil$ block cipher calls or "cycles" as you call them to process the full message, where $l$ is the mesage length (in bits), $n$ the block size (in bits) and $\lceil\cdot\rceil$ is the ceiling function.
However, you get the encryption of the $i$-th plaintext block after the $i$-th "cycle" or block cipher call. This can be seen if you look at the formal definition of the CFB-mode which reads (in this case): $$c_i=p_i\oplus E_K(c_{i-1}),\quad c_0=IV$$

where $c_i$ is the $i$-th ciphertext block, $p_i$ is the $i$-th plaintext block, $\oplus$ is bitwise XOR and IV is an initialization vector.

  • 1
    $\begingroup$ What about the segment size (or shift register) $s$? It can be smaller than the block size and would require more "cycles". Something like $\lceil\frac{l}s\rceil$. $\endgroup$
    – Artjom B.
    May 27, 2017 at 18:43
  • 1
    $\begingroup$ @ArtjomB. for the purpose of this answer and for simplification I chose the most convenient shift register size, of course if you want to use the full power of CFB (for whatever reason) your comment has the more correct calculation. $\endgroup$
    – SEJPM
    May 27, 2017 at 18:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.