Version 5.0 The LEDA User Manual

corresponding block in the plaintext and one bit in the next block. And in CFB mode
the corresponding bit in the plaintext is affected as well as the complete next block. As
to security ECB is clearly the worst because patterns in the plaintext are not hidden.
The other three modes hide these patterns and they are almost comparable in terms of
security. CBC has some small advantages (cf. [80, Chapter 9.11]). So if your are in doubt
use CBC as stream-cipher.
The following table summarizes some facts about the stream-ciphers in LEDA:
mode encryption decryption IV security
ECB C i = E K (P i ) P i = D K (C i ) none −
CBC C i = E K (P i ⊕ C i−1 ) P i = D K (C i ) ⊕ C i−1 unique +(+)
CFB C i = P i ⊕ E K (C i−1 ) P i = C i ⊕ E K (C i−1 ) unique! +
OFB C i = P i ⊕ S i , S i = E K (S i−1 ) P i = C i ⊕ S i unique +
As stated above a block-cipher is needed to make the stream-ciphers work. The following
block-ciphers are part of LEDA:
block-cipher block size / bits key-size / bits
Blowfish 64 32 – 448
Twofish 128 128 – 256
Rijndael (AES) 128 128 – 256
Comparing the ciphers in terms of performance Blowfish comes out worst (probably because
of the smaller block size). Our implementation of Twofish is slightly faster than
that of Rijndael. In terms of security it is hard to rank the three ciphers. All of them have
been intensively cryptoanalyzed and no weaknesses have been found so far. Blowfish is
used in the ssh command of Unix, Rijndael won the contest for the Advanced Encryption
Standard (AES), and Twofish reached the final round of that contest.