# 64 bit clock cipher with CFB mode. One-byte defected from ciphertext. What is the number of bits defected from plaintext

I have a question from an exam;

We encrypted a message of size 100 Bytes with CFB. In the transmission, byte number 12 got defected. How many bits defected will be in the decryption. The answer is 72 bits and I don't understand why?

• yes the block has 64 bit size.but i still don't understand... – Omer Michleviz Feb 10 '19 at 12:46
• Hint: CFB encryption and decryption are pictured here. Redraw it in your case (which uses a different block width). Examine what "transmitted byte number 12 got defected" means in this, and what that change can influence in the decryption. Notice that, contrary to what the question states, we can not tell for sure how many bits are influenced, and that 72 bits actually is extremely unlikely. The actual answer is 2 to 72 bits. – fgrieu Feb 10 '19 at 12:49
• Is "defected" errored? – kodlu Feb 10 '19 at 20:55

The decryption of CFB mode as follows;

$$P_i = E_k(C_{i-1}) \oplus C_i$$ $$C_0= \operatorname{IV}$$

Bit flipping attack in CFB

If there is a Bit Flipping attack in the ciphertext then we have two cases. $$\color{red}{\textbf{Red case:}}$$ The last ciphertext bit is flipped. This only affects the corresponding plaintext block. So the attacker can change a plaintext bit without affecting any other bits.

$$\color{ForestGreen}{\textbf{Green case:}}$$ Assuming that the $$i$$th ciphertext bit is changed, $$0 \leq i < n$$ where $$n$$ is the total number of blocks, then this time two plaintexts blocks are affected. We can also see from the equations, too;

$$P_i = E_k(C_{i-1}) \oplus \color{blue}{C_i}$$ $$P_{i+1} = E_k(\color{blue}{C_{i}}) \oplus C_{i+1}$$

Note: Bit flipping on IV of CFB mode has no good effect as in CBC mode.

Since you have 100 Bytes, and 64-bit block cipher has 8-byte block size, the 12th-byte number falls into the second ciphertext. If it falls into the last one then only one byte is effected, $$\color{red}{\textbf{red case}}$$.
Now, since we are in the $$\color{ForestGreen}{\textbf{green case}}$$, for a defected one-byte $$C_i$$, we will see two plaintexts are effected $$P_i$$ and $$P_{i+1}$$. $$P_i$$ has one byte defection and $$P_{i+1}$$ has full block defection.
• For a 64-bit block cipher there will be 2 to 72 bits in error, rather than 72 bits as the question's account of the problem/solution states. 2 could occur for a 1-bit error in $C_i$ combined with the unlikely case that it causes only a 1-bit error in $E_k(C_i)$; which for an ideal cipher occurs with probability $64/(2^{64}-1)$. 72 could occur for an 8-bit error in $C_i$ combined with the unlikely case that it causes a 64-bit error in $E_k(C_i)$; which for an ideal cipher occurs with probability $1/(2^{64}-1)$. – fgrieu Feb 10 '19 at 13:09