Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
What is the difference between cfb and cfb1 and cfb8 ? like openssl's aria-128-cfb and aria-128-cfb1 and aria-128-cfb8
edit: interestingly enough, there's also references to a cfb128 (example)
(title says it all but CSE won't let me post a question without a message body)
What is the difference between cfb and cfb1 and cfb8?
Well, first of all, we need examine what CFB is. Here is what the encryption process is:
Take the previous $n$ bits of ciphertext (where $n$ is the block size of the cipher, for Aria, $n=128$
Send it through the block cipher in encryption mode
Extract $k$ bits of the result, exclusive-or that with the next $k$ bits of block text, and make that the next $k$ bits of ciphertext.
That's it. Each iteration of the loop encrypts $k$ bits of plaintext, generating $k$ bits of ciphertext, and performs one block cipher operation.
And, to answer your question:
For cfb1, $k=1$
For cfb8, $k=8$
For cfb, $k=n$ (or 128 for Aria)
Of course, you might ask "why in the world would anyone use cfb1? To encrypt 128 bits, it runs Aria 128 times, that's dreadfully inefficient"
The answer is "in case the ciphertext might be accidentally corrupted by bit insert or deletions". The original idea was that CFB was targeted toward encrypting traffic going over serial interfaces, such as RS-232 or Bisync. Now, RS-232 has the property that, due to line noise, an additional character might be received, or a transmitted character might be dropped (Bisync might have that same property with bits; I've never worked with Bisync, so I'm not certain). Now, if we consider using CBC mode to encrypt the traffic, well, after such a character insert/delete error, the blocks used by the encryptor and decryptor will not match up, and so the decryptor will get gibberish (and it will continue to get gibberish long after the error). In contrast, with CFB8, the next 16 characters will be decrypted incorrectly; then, as long as no further errors occurred, the decryption will proceed correctly. CFB1 has the advantage that it can do with individual bits being inserted or deleted.
Of course, all that is historical. Today, we generally are more sensitive to the issues that an adversary can cause by deliberately introducing error. Because of that, we generally want to discard traffic which might be decrypted incorrectly, rather than passing it on (and so the error nonpropogation properties of CFB as not as attractive).
