Problem - Kevin Tafuro

shares many properties with CTR mode, although CTR mode has additional benefits.
Therefore, OFB mode is seeing less and less use these days.
OFB mode has been standardized by NIST.
The primary disadvantages of OFB mode are:
• Bit-flipping attacks are easy, as with any streaming mode. Again, integrity checks
are a must.
• Reusing a {key, none} pair is disastrous (but is easy to avoid). Generally, if there
is any significant risk of reusing a {key, nonce} pair (e..g., across reboot), it is
best to avoid reusing a single key across multiple messages or data streams. (See
Recipe 4.11 for advice if you wish to use one base secret, and derive multiple
secrets from it.)
• Keystream computation cannot be done in parallel.
The primary advantages of OFB mode are:
• Keystreams can be precomputed.
• For ciphers where raw encryption and decryption operations require separate
algorithms (particularly AES), only a single algorithm is necessary. In such a
case, the faster of the two algorithms can be used (though you will get incompatible
results if you use decryption where someone else uses encryption).
• It does not have nonce-size problems when used with 64-bit block ciphers.
• When used properly, it leaks information at the same (slow) rate that CTR mode
does.
We discuss OFB mode in Recipe 5.8.
Cipher Feedback (CFB) mode
CFB mode generally works similarly to OFB mode, except that in its most common
configuration, it produces keystream by always encrypting the last block of ciphertext,
instead of the last block of keystream.
CFB mode has been standardized by NIST.
The primary disadvantages of CFB mode are:
• Bit-flipping attacks are easy, as with any streaming mode. Again, integrity checks
are a must.
• Reusing a {key, nonce} pair is disastrous (but is easy to avoid). Generally, if
there is any significant risk of reusing a {key, nonce} pair (e.g., across reboot), it
is best to avoid reusing a single key across multiple messages or data streams.
• Encryption cannot be parallelized (though decryption can be).
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Selecting a Cipher Mode | 167