# OFB mode and CFB mode error propagation in 64bits

I am trying to understand (in simple terms), how error propagation works in the transmission of ciphertext in both OFB and CFB using a 64bit mode. I am having a hard time understanding the mathematical concepts put into simple terms. Thanks.

First, approximately nothing in modern cryptography cares about the notion of error propagation in block cipher modes of operation—it is an archaic relic of the dark ages of crypto engineering that left us with hopelessly confusing concepts like ‘block cipher modes of operation’ thrust into the faces of hapless application engineers. If you want to detect errors you should use authenticated encryption (unless you have a strong reason to suspect they will be uniform rather than malicious in which case an error-detecting code like a CRC is better).

So unless you're answering an exam question in a class that you might want to drop anyway, it's not likely to figure into anything in the real world. There's hardly ever any reason to use CFB or OFB anyway: CTR is simpler and faster and more widely deployed as part of the authenticated encryption scheme AES-GCM.

Also, while the block size doesn't affect the answer to this question about CFB mode and OFB mode, you should never use a 64-bit block cipher (even if it has larger keys, like 3DES or Blowfish or IDEA; the block size, not the key size, is the problem) until you understand how bad it can be and why the badness is inapplicable to your needs.

That having been said…

The basic idea of CFB is to use the encryption of the IV as a one-time pad for the first block, and use the encryption of the first ciphertext block as a one-time pad for the second block, and so on: if the plaintext is $P = P_1 \mathbin\Vert P_2 \mathbin\Vert P_3 \mathbin\Vert \cdots$, then the ciphertext is $C = C_1 \mathbin\Vert C_2 \mathbin\Vert C_3 \mathbin\Vert \cdots$, where

\begin{align*} C_1 &= P_1 \oplus E_k(\mathit{IV}), \\ C_2 &= P_2 \oplus E_k(C_1), \\ C_3 &= P_3 \oplus E_k(C_2), \\ &\vdots \end{align*}

The basic idea of OFB is to use the encryption of the IV as a one-time pad for the first block, and use the encryption of the first pad block as a one-time pad for the second block, and so on:

\begin{align*} C_1 &= P_1 \oplus E_k(\mathit{IV}), \\ C_2 &= P_2 \oplus E_k(E_k(\mathit{IV})), \\ C_3 &= P_3 \oplus E_k(E_k(E_k(\mathit{IV}))), \\ &\vdots \end{align*}

What happens if, during transmission, $C_2$ gets replaced by $C'_2 = C_2 \oplus \varepsilon$ for some error pattern $\varepsilon$? Then we will have $C' = C_1 \mathbin\Vert C'_2 \mathbin\Vert C_3 \mathbin\Vert \cdots$, which, on decryption, gives $P' = P'_1 \mathbin\Vert P'_2 \mathbin\Vert P'_3 \mathbin\Vert \cdots$. Let's examine how $P'_i$ is related to $P_i$.

1. The equation for $P'_1$ depends only on $C'_1 = C_1$ and $\mathit{IV}$, so $P'_1 = P_1$ is unaffected, both in CFB mode and in OFB mode.

2. In CFB mode, $P'_2 = C'_2 \oplus E_k(C_1) = \varepsilon \oplus C_2 \oplus E_k(C_1) = \varepsilon \oplus P_2$. Likewise, in OFB mode, $P'_2 = C'_2 \oplus E_k(E_k(\mathit{IV})) = \varepsilon \oplus C_2 \oplus E_k(E_k(\mathit{IV})) = \varepsilon \oplus P_2$. So the same bits flipped in $C'_2$ from $C_2$ get flipped in $P'_2$ from $P_2$.

3. What about $P'_3$? Find an equation for $P'_3$ from the relations above in CFB mode and in OFB mode, and see if you can figure out how $P'_3$ is related to $P_3$.

4. What about $P'_4$? Does the answer change appreciably from the answer for $P'_3$?

• Oh wow, that is very interesting. Thank you so much, i did not know how out dated these methods were. – Randal Mar 1 '18 at 5:28