# May the problem with DES using OFB mode be generalized for all feistel ciphers

There is a problem with using DES as the block cipher in OFB mode, eg: the feedback that goes back into the next round will be encrypted with the same key $k$ resulting back into the plaintext IV used in the first round, and this goes on and on until OFB is done.

So the output of the block cipher is deterministic and repetitive.

So, as we know using a feistel cipher has the nice property that running it twice through the cipher (with reverse ordening of subkeys) results back in the plaintext, so is it ok to say that the problem with using DES in OFB mode is true for all Feistel ciphers? Or is the reason that DES has a problem with OFB something different?

Thanks again for the clear response!

[EDIT] My initial assumption was wrong, the problem that encryption something twice with DES is a result from using a "weak key" not from the feistel structure. Sorry.

So to be sure, with DES, only when you encrypt something twice with a weak key. You get the back the original plaintext? So when using DES in OFB mode with a weak key would result in information leakage.

• "So, as we know using a feistel cipher has the nice property that running it twice through the cipher results back in the plaintext" not really, the subkeys are processed in the opposite order. – Thomas Apr 8 '13 at 9:36
• Yes, very true. Let me fix that. – Lee. M Apr 8 '13 at 9:45
• Your argument only works if reversing the subkeys has no effect. – CodesInChaos Apr 8 '13 at 9:52
• The assumption you based this question on is flawed (as Thomas pointed out): with DES, reencrypting the block with the same data does not result in the original plaintext (unless you use a weak key). You fixed some later text to reflect this, but your original question relies on this assumption. – poncho Apr 8 '13 at 13:42
• @SanderDemeester: yes, as long as $k$ is not a DES weak key, then encrypting $P1$ and then encrypting $C1$ is quite unlikely (probability $2^{-63}$) to result in $P1$. Remember, OFB was originally designed with DES in mind; it is unlikely that the designers missed something this drastic. – poncho Apr 8 '13 at 15:46

The question has morphed over time. I am answering the following.

So to be sure, with DES, only when you encrypt something twice with a weak key. You get the back the original plaintext?

That is correct as that is the definition of a DES weak key, a key for which encryption and decryption have the same effect.

So when using DES in OFB mode with a weak key would result in information leakage.

Yes. In fact the information leakage is great. The output of every other blockcipher call would be the original IV which is assumed to be public knowledge, so the attacker can decrypt every other block w/o knowing the key. Further more the odd numbered blocks (if we start our numbering with 1) will all be encrypted with the same keystream. So that is a weakness in and of itself. But, even more so, since there are only 4 weak keys, the attacker can surely figure out the odd numbered blocks too (once he knows a weak key was used).

That said, DES has too small of a key space and should not be used.

• Sorry for my late reaction. Thank you for answer my question! – Lee. M Apr 10 '13 at 12:59

A quick follow up, there is a problem with using DES in OFB mode when you are not using the full feedback register.

The generated keystream will become cyclic with on average a period of the order $2^{32}$ instead of $2^{64}$.

See

(R.R. Jueneman, “Analysis of certain aspects of Output Feedback Mode,” Advances in Cryptology, Proceedings Crypto’82, D. Chaum, R.L. Rivest, en A.T. Sherman, Eds., Plenum Press, New York, 1983, pp. 99–127).

• I suggest amending your citation to provide a complete citation. (List the authors and the year. When you say Advances in Cryptology, do you mean the CRYPTO conference, and if so, what year?) – D.W. Apr 16 '13 at 1:32
• Yes, ive updated the original response. – Lee. M Apr 16 '13 at 6:28
• There is the same problem with any cipher in a bad variant of OFB mode, where only part of the output (rather than the whole) is fed back into the input. That was originally in FIPS PUB 81, but has been removed: "After the publication of FIPS 81, it was discovered that when less that 64 bits of feedback are used in the OFB mode, there is a risk of generating short cycles. (..) Because of this short cycle property, NIST does not support the use of the OFB more for any amount of feedback less than 64 bits." – fgrieu Apr 16 '13 at 10:13