🔐Output Feedback Mode

NEW

Also known as: OFB Mode, OFB

A block cipher mode that generates keystream by feeding cipher output back for encryption, making a stream-like confidentiality mode.

DESCRIPTION

Output Feedback (OFB) mode turns a block cipher into a synchronous stream cipher. It encrypts an initialization vector and repeatedly feeds the output back into the block cipher to produce keystream, which is XORed with plaintext. OFB avoids error propagation but requires unique IVs to prevent keystream reuse. It provides confidentiality only and must be paired with authentication for integrity.

ALTERNATIVE DEFINITIONS

NIST SP 800-38A

The Output Feedback (OFB) mode is a confidentiality mode that uses a block cipher to generate a sequence of output blocks, which are XORed with the plaintext to produce the ciphertext.

Defines OFB as a confidentiality mode and keystream generator.

Source

Wikipedia

OFB is a stream cipher mode that generates keystream blocks, which are then XORed with the plaintext blocks to get the ciphertext.

Emphasizes stream-like behavior and XOR operation.

Source

RELATED TERMS

Galois-Counter Mode Symmetric Block Cipher Algorithms Stream Cipher Rijndael Initialization Vector Keystream Padding

COMPETING TERMS

CTR Mode Cipher Feedback Mode CBC Mode

RELATIONS

• Broader: Mode

KNOWLEDGE AREAS

Data Security

TARGET AUDIENCE

Cybersecurity Engineer Security Architect Chief Information Security Officer Software Developer

EXTERNAL SOURCES

• Wikipedia - Block cipher mode of operation#Output feedback (OFB)
• OpenSSL - API supporting OFB mode
• Crypto++ - Library documentation for OFB mode

TOP QUESTIONS

Why use Output Feedback Mode instead of CBC?

OFB avoids error propagation and padding, and operates as a stream; however, it lacks built-in integrity protection.

Category: Alternatives

What is the biggest risk with OFB?

Reusing IVs produces identical keystreams, enabling XOR-based recovery of plaintext differences.

Category: Risks

How does OFB compare to CTR Mode?

Both produce keystreams; CTR uses counters, OFB feeds back outputs. CTR parallelizes easily; OFB is sequential.

Category: Opinion

Does OFB provide integrity?

No, OFB provides confidentiality only; pair with MAC or use an AEAD mode.

Category: Requirements

What are common mistakes when implementing OFB?

IV reuse, weak random IV generation, and missing authentication are frequent errors.

Category: Mistakes

Is OFB suitable for streaming data?

Yes, it functions like a stream cipher and handles variable-length data without padding.

Category: Overview

How should IVs be chosen for OFB?

Use random, unique IVs per message; never reuse IVs for the same key.

Category: Best practices

What standards reference OFB?

NIST SP 800-38A formally defines OFB and other block cipher modes.

Category: Overview

What are practical alternatives to OFB for modern systems?

Prefer AEAD modes like AES-GCM or ChaCha20-Poly1305 for integrated confidentiality and integrity.

Category: Alternatives