Alice uses the OFB mode to encrypt her emails sent to Bob, but instead of using randomly generated IVs, she always uses the same IV to encrypt her emails. Charlie somehow gets the following data:

  • The first 8 bits of the first ciphertext block: 0x11010101
  • The first 8 bits of the first plaintext block: 0x01111001
  • The first 8 bits of the second ciphertext block: 0x10100100
  • The first 8 bits of the second plaintext block: 0x11001010

Charlie also get a copy of Alice’s newly encrypted message, the first 8 bits of the first two blocks are 0x01010010 and 0x01101001, respectively.

Please derive the first 8 bits of the first two blocks of the plaintext.

  • 2
    Since I assume this is homework, what have you tried so far? Have you looked at this diagram for OFB? – AndrolGenhald Sep 14 at 4:55
  • This is homework and a hint: This is a pure IV-reuse in OFB and CTR mode of the block and some stream ciphers. When IV reuses you can apply the two-time or may-time pad attack like in OTP. – kelalaka Sep 14 at 9:25
  • This is a copy/paste of a homework question. While can can help with homework, you need to show us how you've tried to answer the question yourself. We won't do your homework for you. – schroeder Sep 14 at 14:44
  • 1
    If fact, it's from here: handsonsecurity.net/files/problems/Encryption_ex.pdf – schroeder Sep 14 at 14:44

Since OFB generates a keystream by encrypting the IV, then encrypting the previous keystream block, by reusing an IV the keystream will be the same. Since XOR is associative and commutative, we can derive:

a ⊕ b = c
(a ⊕ b) ⊕ b = (c) ⊕ b
a ⊕ (b ⊕ b) = c ⊕ b
a ⊕ 0 = c ⊕ b
a = c ⊕ b

In other words:

keystream ⊕ plaintext = ciphertext (from the diagram)
keystream = ciphertext ⊕ plaintext

Since you have the first 8 bits of the ciphertext and plaintext, you can recover the first 8 bits of the keystream. Then, you can use the same method to decrypt the unknown plaintext:

0b11010101 ⊕ 0b01111001 = 0b10101100 (ciphertext1 ⊕ plaintext1 = keystream)
0b10101100 ⊕ 0b01010010 = 0b11111110 (keystream ⊕ ciphertext2 = plaintext2)

So the first 8 bits of the first block of the new message is 0b11111110. Using the same method, you should be able to figure out the second block.

Not the answer you're looking for? Browse other questions tagged or ask your own question.