8-bit CFB in DES and AES - error propagation

Question

I have two questions for an assignment that I need to answer in relation to Error Propagation in 8-bit CFB mode for AES and DES encryption. The questions are as follows:

1. If there is an error in transmitted ciphertext block C1, how many plaintext blocks will be corrupted when the file is decrypted for 8-bit CFB-DES?
2. If there is an error in transmitted ciphertext block C1, how many corrupted plaintext blocks when 8-bit CFB-AES is used?

For question 1 I know the answer is 9 characters, as P1 will be affected and so will the following 8 characters (Avalanche effect). But why, when using AES, will 17 bits be affected, ie. P1 and the following 16 characters? I tested this encryption using openssl -AES-256-CFB8 and -DES-CFB8 on Linux Ubuntu.

Answer 1

17 bytes are affected in AES mode, not 17 bits. This is because the block size of AES is 16 bytes instead of 8 bytes for DES.

When you change the ciphertext it directly affects the bits that are at the same location of the plaintext, plus the time it takes to get out of the shift register, which is the size of the block size of the cryptographic primitive, i.e. 8 bytes for DES and 16 bytes for AES.

The question is however how many blocks are affected, not how many bytes. Note that the block size of CFB will be set to 1 bit, not the block size of the underlying block cipher. CFB is a stream mode after all.

So you could say that 9 * 8 = 72 blocks are affected for DES or indeed 17 * 8 = 136 for AES. This is probably not what is meant by the teacher, you're better off guessing 2 blocks for both or 9 for DES and 17 for AES. Also see the explanation by SEJPM here.

---

The nice thing about CFB8 mode is that if you drop or insert a byte that it will re-synchronize. What it won't do is to only flip those plaintext bits that are changed in the ciphertext, such as CTR mode does.

Nowadays we're not that interested anymore. We tend to catch transmission errors in a lower layer and then only decrypt if the entire ciphertext is available, preferably using authenticated encryption to catch any changes to the ciphertext (deliberate or otherwise).

Note also that CFB8 mode is terribly expensive; it requires a block encrypt for each byte that is transmitted, both for encrypting as decrypting.