3
$\begingroup$

I am looking at implementing AES128 bit encryption of a data stream. Since AES128 is a block cipher, which is inherently less robust than a stream cipher, I have considered configuring AES128 as a stream cipher in OFB mode as shown here. If I use the same IV, will it be more robust than standard ECB (block) mode?

Improve this question
$\endgroup$
1
  • 1
    $\begingroup$ Both are broken as SEJPM correctly mentioned in his answer. However, there are better alternatives to these old primitives, even if a unique IV cannot be provided, for instance Format Preserving Encryption (FPE) or SIV. Neither of those will prevent information leakage for repeated messages though - you will be able to identify the repetition. $\endgroup$
    – Maarten Bodewes ♦
    Sep 20, 2017 at 12:08

1 Answer 1

Reset to default
5
$\begingroup$

OFB with an IV re-use is a different kind of completely broken than ECB.

In ECB mode, the problem is the fact that you can recognize blocks. That is if the same block appears twice you will notice that and know the underlying message-blocks were the same.

In OFB mode, the problem is the re-use of the key-stream. That is for any two ciphertexts under the same IV/key pair, you can compute the XOR of the underlying messages. Note that if you know (parts of) either message this allows you to recover (parts of) the other message.

So with ECB mode it's hard to actually infer the precise contents of the message but you can detect patterns in the ciphertext, whereas OFB hides patterns in a single ciphertexts, but leaks a lot of information with two ciphertexts.

Improve this answer
$\endgroup$
3
  • $\begingroup$ And which do you think would be the least secure in this case, i.e easiest infer the plain text? ECB or OFB with the same IV/Key? $\endgroup$
    – mr_js
    Sep 20, 2017 at 11:07
  • 2
    $\begingroup$ @mr_js they are both highly insecure in general, which is less insecure depends on the situation a lot. I can imagine scenarios where bad OFB would be the right pick and others where ECB would be. $\endgroup$
    – SEJPM
    Sep 20, 2017 at 11:26
  • 1
    $\begingroup$ Notice that this means that as long as you use a different (e.g. random) key for each encryption, AES-OFB will be safe... But it is broken as long as you reuse the same key and IV at the same time. $\endgroup$
    – Lery
    Sep 20, 2017 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.