# Known Plaintext Attack for Modified OFB Mode of Operation

Question: Assume a variant of the OFB mode by which we only feedback the 8 most significant bits of the cipher output. We use AES and fill the remaining 120 input bits to the cipher with 0's:

1. Why is this scheme weak, if we encrypt moderately large blocks of plaintexts, say 100-KByte? What is the maximum number of known plaintexts an attacker needs to completely break the scheme?

2. Let the feedback byte be denoted FB. Does the scheme become cryptographically stronger if we feedback the 128-bit value $$FB,FB,FB,\ldots,FB$$ to the input (i.e.) copy the feedback byte 16 times and use it as AES input?

Solution:

1. The problem with the scheme is that there are only 256 different inputs $$FB_i$$ to the AES algorithm. That means there are only 256 different output vectors of length 128 bit that form the keystream. To make things worse, the cipher output will run into cycle quickly. Let's denote the sequence of feedback bytes by $$FB_1,FB_2,\ldots$$ As soon as the feedback byte $$FB_j$$ is generated that is equal to an earlier one $$FB_i$$, i.e. $$i, the sequence;$$FB_i,FB_{i+1},FB{i+2},\ldots,FB_j=FB_i,FB_{i+1},\ldots$$ Repeats periodically. Since there are only 256 different values for $$FB$$, the maximum sequence length is 256. Since each value is associated with a 128 bit (16-byte) AES output, the keystream sequence $$s_i$$ has a maximum cycle length of:

128x16= 2048 byte= 2kbyte. ( Isn't that wrong? Should be 256x16 in my opinion? )

After this, the stream cipher output must repeat(and odds are that the cycle length is much shorter). Thus if an attacker has to know at most 2 kbyte of plaintext in order to recover the entire system stream cipher output with which he can decrypt all other ciphertexts.

2. No, we still only generate a maximum of 256 keystream words of length 16 byte.

This solution is from the manual of the book. I did not get why it is 128x 16 insteaf of 256x 16 in part 1? Can anyone explain it to me. Also i did not get the part 2 at all. I need a comprehensive explanation.

• @kelalaka this is not my solution. I got tuis from the solution manual. There are some points that i did not understand at (i). i think it should be 256x 16 not 128x 16? Where am i doing mistake? Do you think it is correct above? Or do you agree with me? And can you please explain the (ii) solution i did not get it at all? Thanks – esra Oct 26 '18 at 18:03
• @kelalaka i cannot see my "edit " button under the question? Why do you think this happens? – esra Oct 26 '18 at 18:06

## 1 Answer

1. It should be $$256*128 = 4096$$ bytes. The period at most 256 and each encryption outputs 128-bits.

2. When the $$FB,FB,\ldots,FB$$ series enter the plaintext, again we are taking the 8 MSB form the ciphertext that has still 256 different possibilities. To see the picture clearly;

1. In the first case the input space has only 256 plaintexts consist of 120-zero and the 8-bit.
2. In the second case the input space still has 256 plaintexts consist of repeating bytes. $$00\ldots 00, 01\ldots 01, \ldots , FF\ldots FF$$ Again, once $$FB_i = FB_j, i \neq j$$ we will have a cycle with at most 256 period.