1
$\begingroup$

I was wondering if CFB can be better than OFB in any ways. I would like to know in what cases one would use CFB over OFB.

$\endgroup$
  • $\begingroup$ They're both silly; there's no reason to use either one instead of CTR, and while you're at it, you should be using an authenticator, and generally use an authenticated encryption scheme. AES-GCM is an example; crypto_secretbox_xsalsa20poly1305 is another. $\endgroup$ – Squeamish Ossifrage Apr 8 '18 at 15:40
5
$\begingroup$

The only reason I can imagine why one would prefer CFB over OFB or CTR is error propagation. Another reason may be technical issues with the relieability of the transmission line.

This comes from the fact that if you flip a single bit in an OFB ciphertext then you only get the same bit flipped in the underlying plaintext. But if you flip a single bit in CFB mode, you get the bit flipped in the plaintext and get the following block to decrypt to gibberish. So there's a larger chance of you detecting a manipulation of the ciphertext because the effect on the plaintext is bigger.

However the above reason stems from the dark ages of cryptography, where authenticated encryption was usually done ad-hoc or not at all, so people actually relied on these error propagation properties. These days, using anything but CTR is pointless, because CTR allows very nicely for SIMD parallelization and error propagation as a property is kinda irrelevant because the authentication tag will catch any modifications.

$\endgroup$
  • 1
    $\begingroup$ Addition: CFB has a drawback worth mention compared to OFB: a collision of ciphertext blocks leads to a potentially exploitable relation for the plaintext blocks that follow (their XOR is also the XOR of the ciphertext blocks that follow), and is observable if it occurs. This becomes an issue for mere gigabytes of data for 64-bit block ciphers (like 3DES, Gost..). There's a comparable issue with CBC. By contrast, OFB remain secure for a petabyte, as long as the key is not used for multiple IVs. CTR brings several further improvements. $\endgroup$ – fgrieu Apr 8 '18 at 13:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.