In OFB mode, I understand that a bit flip in $c_i$ for $i > 0$ only causes a bit flip in message block $m_i$. However, how is it possible for a bit flip in $c_0$ (i.e, in IV) will result in all the plaintext blocks being recovered incorrectly.

  • $\begingroup$ Once you pass 15 points, you can upvote the answers, too. Welcome. $\endgroup$
    – kelalaka
    Mar 26, 2022 at 0:11

1 Answer 1


OFB mode produces a stream by feedbacking the output of the previous encryption as the input of the next block;

$$O_j = E_K(I_j)$$ $$I_j = O_{j-1}$$ $$I_0 = IV$$

The output stream $O_j$ is used to x-or to produce the ciphertext/plaintext depending on the encryption/decryption mode.

  • $C_j = P_j \oplus O_j$ for encryption
  • $P_j = C_j \oplus O_j$ for decryption.

Now if you modify the IV, then the output of the $O_1$ will change to something else. Then the next stream input $I_2$ will use this changed output as input so that $O_2$ is changed, too. The rest follows and you will get different output streams this will result in different decrypted plaintexts.

One can follow from the red bit flipping and the affected red lines from the below figure;

enter image description here

And the green is used for the effects of the ciphertext modification.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.