Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about Counter mode (CTR) the authors say that:
"As a result, its performance is identical to OFB's when errors are introduced in the ciphertext."
What does this mean ? The authors don't explain it
What it means is that neither CTR nor OFB detects errors in a message, and that an adversary can flip arbitrary bits of their choice in the plaintext very easily—by flipping the corresponding bits of ciphertext. This is because both CTR and OFB essentially work by using the block cipher as a stream cipher to pseudorandomly generate a one-time pad to xor with the plaintext.
This implies that an adversary can easily change one message like ‘Attack at dawn!’ to another message like ‘Attack at dusk!’ and the recipient of the message will be none the wiser. Worse, an adversary can change a message like ‘Put the secret message in locker 42!’ to ‘Put the secret message in locker 41!’, and then by acting on the message your confidentiality goes out the window. This is not merely theoretical; this actually happened in a major real-world protocol, OpenPGP, in EFAIL, because OpenPGP was badly designed.
To avoid this, you should generally use an authenticated cipher like AES-GCM or NaCl crypto_secretbox_xsalsa20poly1305. An authenticated cipher detect any errors, whether random errors or malicious forgery attempts, with high probability.
You should also forget that ‘block cipher modes of operation’ exist at all—just focus on the complete construction AES-GCM. The fact that there's a block cipher somewhere in there is not important to anyone except a cryptographer designing a system. What matters is the security contract which tells you what your obligations are for using AES-GCM and what security you get in exchange.
