# 64 bit clock cipher with CFB mode. One-byte defected from ciphertext. What is the number of bits defected from plaintext

I have a question from an exam;

We encrypted a message of size 100 Bytes with CFB. In the transmission, byte number 12 got defected. How many bits defected will be in the decryption. The answer is 72 bits and I don't understand why?

• yes the block has 64 bit size.but i still don't understand... Feb 10, 2019 at 12:46
• Hint: CFB encryption and decryption are pictured here. Redraw it in your case (which uses a different block width). Examine what "transmitted byte number 12 got defected" means in this, and what that change can influence in the decryption. Notice that, contrary to what the question states, we can not tell for sure how many bits are influenced, and that 72 bits actually is extremely unlikely. The actual answer is 2 to 72 bits.
– fgrieu
Feb 10, 2019 at 12:49
• Is "defected" errored? Feb 10, 2019 at 20:55

The decryption of CFB mode as follows;

$$P_i = E_k(C_{i-1}) \oplus C_i$$ $$C_0= \operatorname{IV}$$

Bit flipping attack in CFB

If there is a Bit Flipping attack in the ciphertext then we have two cases. $$\color{red}{\textbf{Red case:}}$$ The last ciphertext bit is flipped. This only affects the corresponding plaintext block. So the attacker can change a plaintext bit without affecting any other bits.

$$\color{ForestGreen}{\textbf{Green case:}}$$ Assuming that the $$i$$th ciphertext bit is changed, $$0 \leq i < n$$ where $$n$$ is the total number of blocks, then this time two plaintexts blocks are affected. We can also see from the equations, too;

$$P_i = E_k(C_{i-1}) \oplus \color{blue}{C_i}$$ $$P_{i+1} = E_k(\color{blue}{C_{i}}) \oplus C_{i+1}$$

Note: Bit flipping on IV of CFB mode has no good effect as in CBC mode.

Since you have 100 Bytes, and 64-bit block cipher has 8-byte block size, the 12th-byte number falls into the second ciphertext. If it falls into the last one then only one byte is effected, $$\color{red}{\textbf{red case}}$$.

Now, since we are in the $$\color{ForestGreen}{\textbf{green case}}$$, for a defected one-byte $$C_i$$, we will see two plaintexts are effected $$P_i$$ and $$P_{i+1}$$. $$P_i$$ has one byte defection and $$P_{i+1}$$ has full block defection.

Fgrieu gave the probabilities of the defection in the comments. As noted, the defection is not clear about how many bits are flipped. It may be 1 or 8. Also, the affected full block is not under control. For example, if we assume that the cipher has avalanche criteria we expect each of the ciphertext bits has 50% probability to have a flip. Therefore we can say it is between 1 and 64. So the total number of affected bits is between 2 to 72.

Let finish this with mitigations:

The attack/defection is possible since there is no integrity on the data. A MAC or an HMAC can be used to prevent, or better use authenticated encryption which provides confidentiality, integrity, and authenticity. In TLS 1.3., CCM and GCM are standardized authenticated encryption modes.

• i'm sure if the answer in the exam(72 ) is wrong or i still dont get it.as i see it every block after number 12 will be defected but there is only 100 byes .each block size is 64 bits which is 8 bytes hence, 12 block approximately. so if there is only 12 and the last one got defected ..i mean i get it wrong.can you explain the calculation ? Feb 10, 2019 at 13:08
• For a 64-bit block cipher there will be 2 to 72 bits in error, rather than 72 bits as the question's account of the problem/solution states. 2 could occur for a 1-bit error in $C_i$ combined with the unlikely case that it causes only a 1-bit error in $E_k(C_i)$; which for an ideal cipher occurs with probability $64/(2^{64}-1)$. 72 could occur for an 8-bit error in $C_i$ combined with the unlikely case that it causes a 64-bit error in $E_k(C_i)$; which for an ideal cipher occurs with probability $1/(2^{64}-1)$.
– fgrieu
Feb 10, 2019 at 13:09