0
$\begingroup$

In some block modes, if we change one bit (or more) in the plaintext, the whole block\ciphertext will be changed (i.e ecb: block will be different. cbc: whole ciphertext will be different) Does encryption in OFB mode will defuse the text? if we will change one bit in the plaintext, more than one bit will be changed in the ciphertext ?

$\endgroup$
2
$\begingroup$

if we will change one bit in the plaintext, more than one bit will be changed in the ciphertext?

In Output Feedback Mode, no, it does not. Specifically, if you change one bit of the plaintext and nothing else (e.g. you don't modify the IV), then only the corresponding bit of the ciphertext will change.

Output Feedback Mode works by internally generating a bit string based on the key and the IV, and then exclusive-or's that bit string with the plaintext to form the ciphertext. Any mode that can be described in this way (another example, counter mode) will have this 'non-propagation' property.

This has two immediate implications:

  • You don't want to reuse the same (key, IV) pair to encrypt multiple messages; by xoring the ciphertexts, the attacker would recover the xor of the two plaintexts (which can tell him a lot)

  • You really want an integrity transform (e.g. a MAC) along with OFB mode. Without it, the attacker who guesses what the plaintext is can modify the ciphertext so that it decrypts to any plaintext he wants with the same length. Now, you generally do want to use an encryption method that has protection against modifications (such as a MAC or alternatively use an AEAD mode that provides such protection); it is critical with OFB.

$\endgroup$
3
  • $\begingroup$ What do you mean by that? "You don't want to reuse the same (key, IV) pair to encrypt multiple messages; by xoring the ciphertexts, the attacker would recover the xor of the two plaintexts (which can tell him a lot)". How the attacker will know the xor? can you give a simple example? BTW Many thanks! I still don’t have enough reputation to upvote, so thanks (: 😊 $\endgroup$ Sep 18 at 18:32
  • $\begingroup$ @YotamSofer: trivial example, suppose the plaintext of one is "Hi" (0x48 0x69); suppose it encrypts to 0x6b 0xbe. Suppose you encrypt a second plaintext "Ho" (0x48 0x6f) with the same key/IV; that'll encrypt to 0x6b 0xb8. If you compute the exclusive-or of the two ciphertexts, you get 0x00 0x06; which is precisely the same as the xor of the two plaintexts "Hi" and "Ho" $\endgroup$
    – poncho
    Sep 18 at 19:06
  • $\begingroup$ gotcha, many thanks! $\endgroup$ Sep 18 at 21:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.