2
$\begingroup$

I have two questions for an assignment that I need to answer in relation to Error Propagation in 8-bit CFB mode for AES and DES encryption. The questions are as follows:

  1. If there is an error in transmitted ciphertext block C1, how many plaintext blocks will be corrupted when the file is decrypted for 8-bit CFB-DES?
  2. If there is an error in transmitted ciphertext block C1, how many corrupted plaintext blocks when 8-bit CFB-AES is used?

For question 1 I know the answer is 9 characters, as P1 will be affected and so will the following 8 characters (Avalanche effect). But why, when using AES, will 17 bits be affected, ie. P1 and the following 16 characters? I tested this encryption using openssl -AES-256-CFB8 and -DES-CFB8 on Linux Ubuntu.

Improve this question
$\endgroup$
4
  • 2
    $\begingroup$ FYI, DES and the concept of error propagation are completely obsolete and have been for decades, and there's essentially no reason to ever use CFB (and especially 8-bit CFB) except for compatibility with archaic protocols like OpenPGP (which uses a weird variant of it anyway). See crypto.stackexchange.com/a/56043/49826 for hints about a similar question (plug in the definition of 8-bit CFB to see how it differs), but more importantly, I'm afraid this course may be preparing you for obsolescence. $\endgroup$
    – Squeamish Ossifrage
    Commented May 7, 2018 at 4:51
  • $\begingroup$ And a little more on error propagation vs. the actually useful concept of authentication: crypto.stackexchange.com/a/56107/49826 $\endgroup$
    – Squeamish Ossifrage
    Commented May 7, 2018 at 4:55
  • $\begingroup$ This course isn't preparing me for much tbh.. But thanks! $\endgroup$
    – Liam G
    Commented May 7, 2018 at 4:56
  • 1
    $\begingroup$ I think the question not well defined. The block size of DES and AES is 8 and 16 bytes respectively, but the block size of CFB - a streaming mode of operation - is a single bit. As CFB itself doesn't perform operations on blocks of plaintext the question isn't all that clear to me. $\endgroup$
    – Maarten Bodewes ♦
    Commented May 7, 2018 at 12:15

1 Answer 1

Reset to default
1
$\begingroup$

17 bytes are affected in AES mode, not 17 bits. This is because the block size of AES is 16 bytes instead of 8 bytes for DES.

When you change the ciphertext it directly affects the bits that are at the same location of the plaintext, plus the time it takes to get out of the shift register, which is the size of the block size of the cryptographic primitive, i.e. 8 bytes for DES and 16 bytes for AES.

The question is however how many blocks are affected, not how many bytes. Note that the block size of CFB will be set to 1 bit, not the block size of the underlying block cipher. CFB is a stream mode after all.

So you could say that 9 * 8 = 72 blocks are affected for DES or indeed 17 * 8 = 136 for AES. This is probably not what is meant by the teacher, you're better off guessing 2 blocks for both or 9 for DES and 17 for AES. Also see the explanation by SEJPM here.

The nice thing about CFB8 mode is that if you drop or insert a byte that it will re-synchronize. What it won't do is to only flip those plaintext bits that are changed in the ciphertext, such as CTR mode does.

Nowadays we're not that interested anymore. We tend to catch transmission errors in a lower layer and then only decrypt if the entire ciphertext is available, preferably using authenticated encryption to catch any changes to the ciphertext (deliberate or otherwise).

Note also that CFB8 mode is terribly expensive; it requires a block encrypt for each byte that is transmitted, both for encrypting as decrypting.

Improve this answer
$\endgroup$
3
  • $\begingroup$ I've added an answer to the question if error propagation is useful in modern crypto here. Notice the last comment :) $\endgroup$
    – Maarten Bodewes ♦
    Commented May 7, 2018 at 12:13
  • $\begingroup$ I (now) guess 8-bit CFB re-enciphers the last block of ciphertext-or-IV; then XORs some (unspecified) 8-bit extract of that with 8 bits of plaintext to get ciphertext, and vice-versa on decryption. Is that it? Perhaps that should be added to the answer. Independently, I have a mild terminology issue with "CFB is a stream mode after all". To me a defining property of a stream cipher is that the ciphertext is the XOR of plaintext and a keystream that depends only on key and IV. OFB and CTR apply, not CFB or that 8-bit CFB. $\endgroup$
    – fgrieu ♦
    Commented May 25, 2018 at 10:14
  • $\begingroup$ I'll adjust the first point later, but plaintext aware system ciphers do exist. I agree that without a clear key stream that the term stream cipher could be misleading. But block size is 1 so... $\endgroup$
    – Maarten Bodewes ♦
    Commented May 25, 2018 at 12:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.