Problem - Kevin Tafuro

The primary advantages of CFB mode are:
• For ciphers where raw encryption and decryption operations require separate
algorithms (particularly AES), only a single algorithm is necessary. In such a
case, the faster of the two algorithms can be used.
• A minor bit of precomputational work can be done in advance of receiving a
block-sized element of data, but this is not very significant compared to CTR
mode or OFB mode.
• It does not have nonce-size problems when used with 64-bit block ciphers.
These days, CFB mode is rarely used because CTR mode and OFB mode provide
more advantages with no additional drawbacks.
We discuss CFB mode in Recipe 5.7.
Carter-Wegman + CTR (CWC) mode
CWC mode is a high-level encryption mode that provides both encryption and builtin
message integrity, similar to CCM and OCB modes (discussed later).
CWC is a new mode, introduced by Tadayoshi Kohno, John Viega, and Doug Whiting.
NIST is currently considering CWC mode for standardization.
The primary disadvantages of CWC are:
• The required nonce must never be reused (this is easy to avoid).
• It isn’t well suited for use with 64-bit block ciphers. It does work well with AES,
of course.
The primary advantages of CWC mode are:
• CWC ensures message integrity in addition to performing encryption.
• The additional functionality requires minimal message expansion. (You would
need to send the same amount of data to perform integrity checking with any of
the cipher modes described earlier.)
• CWC is parallelizable (hardware implementations can achieve speeds above 10
gigabits per second).
• CWC has provable security properties while using only a single block cipher key.
This means that under reasonable assumptions on the underlying block cipher,
the mode provides excellent secrecy and message integrity if the nonce is always
unique.
• CWC leverages all the good properties of CTR mode, such as being able to handle
messages without padding and being slow to leak information.
• For ciphers where raw encryption and decryption operations require separate
algorithms (particularly AES), only a single algorithm is necessary. In such a
168 | Chapter 5: Symmetric Encryption
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.