64 bit clock cipher with CFB mode. One-byte defected from ciphertext. What is the number of bits defected from plaintext

Question

I have a question from an exam;

We encrypted a message of size 100 Bytes with CFB. In the transmission, byte number 12 got defected. How many bits defected will be in the decryption. The answer is 72 bits and I don't understand why?

Answer 1

The decryption of CFB mode as follows;

$$ P_i = E_k(C_{i-1}) \oplus C_i$$ $$C_0= \operatorname{IV}$$

Bit flipping attack in CFB

If there is a Bit Flipping attack in the ciphertext then we have two cases.

$\color{red}{\textbf{Red case:}}$ The last ciphertext bit is flipped. This only affects the corresponding plaintext block. So the attacker can change a plaintext bit without affecting any other bits.

$\color{ForestGreen}{\textbf{Green case:}}$ Assuming that the $i$th ciphertext bit is changed, $ 0 \leq i < n$ where $n$ is the total number of blocks, then this time two plaintexts blocks are affected. We can also see from the equations, too;

$$ P_i = E_k(C_{i-1}) \oplus \color{blue}{C_i}$$ $$ P_{i+1} = E_k(\color{blue}{C_{i}}) \oplus C_{i+1}$$

Note: Bit flipping on IV of CFB mode has no good effect as in CBC mode.

Your question

Since you have 100 Bytes, and 64-bit block cipher has 8-byte block size, the 12th-byte number falls into the second ciphertext. If it falls into the last one then only one byte is effected, $\color{red}{\textbf{red case}}$.

Now, since we are in the $\color{ForestGreen}{\textbf{green case}}$, for a defected one-byte $C_i$, we will see two plaintexts are effected $P_i$ and $P_{i+1}$. $P_i$ has one byte defection and $P_{i+1}$ has full block defection.

Fgrieu gave the probabilities of the defection in the comments. As noted, the defection is not clear about how many bits are flipped. It may be 1 or 8. Also, the affected full block is not under control. For example, if we assume that the cipher has avalanche criteria we expect each of the ciphertext bits has 50% probability to have a flip. Therefore we can say it is between 1 and 64. So the total number of affected bits is between 2 to 72.

Let finish this with mitigations:

The attack/defection is possible since there is no integrity on the data. A MAC or an HMAC can be used to prevent, or better use authenticated encryption which provides confidentiality, integrity, and authenticity. In TLS 1.3., CCM and GCM are standardized authenticated encryption modes.