🔁Output Feedback

NEW

Also known as: OFB

A block cipher mode that turns a block cipher into a synchronous stream cipher by generating keystream from successive encryptions of an IV.

DESCRIPTION

Output Feedback (OFB) generates keystream by repeatedly encrypting an initialization vector and feeding back the cipher output, independent of plaintext or ciphertext. This synchronous stream cipher has no error propagation: corrupted ciphertext only corrupts corresponding plaintext bits. OFB requires unique IVs per key to avoid keystream reuse and must never repeat the same IV with a given key. Although it avoids padding and certain error propagation, OFB is less common today than CTR or authenticated modes like GCM.

ALTERNATIVE DEFINITIONS

NIST SP 800-38A

The Output Feedback (OFB) mode is a confidentiality mode that generates keystream blocks, which are then XORed with the plaintext blocks, by repeatedly applying the block cipher to an initial value.

Stresses that keystream depends only on the IV and key, not on plaintext or ciphertext.

Source

OWASP

OFB creates keystream by encrypting an IV and feeding back the output, producing a synchronous stream that avoids error propagation but requires unique IVs to prevent keystream reuse.

Focuses on no error propagation and strict IV uniqueness.

Source

RELATED TERMS

Cipher Block Chaining Initialization Vector Stream Cipher Synchronous Stream Cipher Rijndael AES-GCM Keystream Nonce

COMPETING TERMS

Cipher Feedback Counter

KNOWLEDGE AREAS

Data Security Software Engineering

TARGET AUDIENCE

Security Architect Cybersecurity Engineer Software Developer DevOps Engineer Cloud Architect

EXTERNAL SOURCES

• Wikipedia - Output feedback
• NIST - Authoritative definition of OFB mode
• MDN Web Docs - Web Crypto context on IV and modes
• Cloudflare - Overview of block cipher modes

TOP QUESTIONS

How does Output Feedback (OFB) differ from Cipher Feedback (CFB)?

OFB generates keystream independent of plaintext or ciphertext, while CFB uses previous ciphertext as input. OFB has no error propagation; CFB is self-synchronizing with limited propagation.

Category: Understanding

What is the biggest risk when using Output Feedback (OFB)?

Reusing an IV with the same key repeats keystream, allowing attackers to recover plaintext XORs and potentially message content. Ensure IV uniqueness per key.

Category: Risks

Is Output Feedback (OFB) parallelizable?

Keystream generation can be pipelined but depends on previous output; it’s less parallelizable than CTR, which supports independent block computations.

Category: Limitations

Why is Output Feedback (OFB) less common today?

Modern designs prefer CTR for performance and GCM or ChaCha20-Poly1305 for built-in authentication, reducing misuse risks.

Category: Opinion

Does Output Feedback (OFB) require padding?

No. As a stream cipher mode, OFB XORs a keystream with plaintext and works for arbitrary-length data.

Category: Understanding

How does OFB handle transmission errors?

Bit errors affect only the corresponding decrypted bits and do not cascade, simplifying error handling in noisy channels.

Category: Example

What is a competing alternative to Output Feedback (OFB)?

Counter (CTR) mode offers better parallelization and random access while still avoiding padding.

Category: Alternatives

What IV property is essential for Output Feedback (OFB)?

Uniqueness per key is essential. Predictability matters less than in CBC, but repetition must be avoided.

Category: Requirements

When is Output Feedback (OFB) a reasonable choice?

In constrained systems where padding is undesirable and error resilience is needed, but only with strong IV management and separate authentication.

Category: BestPractices