I found these comments regarding AES OFB Mode: "This mode is a slightly less common mode, quite similar to CFB above, but which should not be used as a stream cipher due to inherent weaknesses when the data width doesn't match the blocksize of the underlying encryption algorithm". Is there any reason why the data width affects the AES OFB mode performance?

  • That comment makes little sense to me. OFB is rarely useful because CTR is almost always better. But I don't see any blocksize vs. datasize matching issues. It's subject to the usual birthday bound, but that requires an awful lot of data. Feb 5, 2013 at 15:56

1 Answer 1


This is a weird assertion. A block cipher in OFB mode is, functionally, a stream cipher which produces a key-dependent stream of pseudorandom bytes; encryption is then just a XOR of the stream with the data to encrypt (and decryption is identical). Data size is quite irrelevant; to the contrary, OFB is one of these modes which require no padding.

What the commentator probably meant is that OFB should not be used with less than full-block feedback. The "normal" OFB is what is described on the Wikipedia diagrams: each output block (from the block cipher) is used as input for the next block cipher invocation. However, in older times, OFB used a partial feedback, in which the input for the block cipher used only part of the output from the previous block. OFB with partial feedback is slower than normal OFB and was meant to support transmission mediums which lose synchronization. Since OFB with partial feedback turned out to be significantly weaker than full-block OFB, the standard deprecated it. My guess is that the comment you quote was about OFB with partial feedback.

Nobody does OFB with partial feedback, except PHP where the MCRYPT_MODE_OFB constant selects OFB with 8-bit feedback (we can count on PHP to select weak and inefficient default values whenever possible; they are very creative that way).

See the Handbook of Applied Cryptography for details (chapter 7, section 7.2.2). Anyway, even full-block OFB can be considered as inferior to CTR on all points and should be avoided (see this answer for more details). And, of course, authenticated encryption like EAX are much better.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .