In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about Counter mode (CTR) the authors say that:

"As a result, its performance is identical to OFB's when errors are introduced in the ciphertext."

What does this mean ? The authors don't explain it


1 Answer 1


What it means is that neither CTR nor OFB detects errors in a message, and that an adversary can flip arbitrary bits of their choice in the plaintext very easily—by flipping the corresponding bits of ciphertext. This is because both CTR and OFB essentially work by using the block cipher as a stream cipher to pseudorandomly generate a one-time pad to xor with the plaintext.

This implies that an adversary can easily change one message like ‘Attack at dawn!’ to another message like ‘Attack at dusk!’ and the recipient of the message will be none the wiser. Worse, an adversary can change a message like ‘Put the secret message in locker 42!’ to ‘Put the secret message in locker 41!’, and then by acting on the message your confidentiality goes out the window. This is not merely theoretical; this actually happened in a major real-world protocol, OpenPGP, in EFAIL, because OpenPGP was badly designed.

To avoid this, you should generally use an authenticated cipher like AES-GCM or NaCl crypto_secretbox_xsalsa20poly1305. An authenticated cipher detect any errors, whether random errors or malicious forgery attempts, with high probability.

You should also forget that ‘block cipher modes of operation’ exist at all—just focus on the complete construction AES-GCM. The fact that there's a block cipher somewhere in there is not important to anyone except a cryptographer designing a system. What matters is the security contract which tells you what your obligations are for using AES-GCM and what security you get in exchange.

  • $\begingroup$ Which are the modes that can detect errors in a message ? $\endgroup$
    – AleWolf
    Commented Oct 17, 2019 at 18:00
  • $\begingroup$ Forget the concept of ‘modes of operation’. Authenticated ciphers can detect errors in a message. I gave two popular examples: AES-GCM and crypto_secretbox_xsalsa20poly1305. $\endgroup$ Commented Oct 17, 2019 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.