Subject: Re: Low-level question about OpenPGP - why CFB mode?

From: "Hal Finney" <[email-masked]>
Date: Wed, 30 Apr 2003 12:43:16 -0700

CFB has two advantages over CBC that might have led to its choice.

First, it only requires the underlying cipher to be run in one direction.
Even in the decryption mode, CFB runs the cipher in encryption mode.
This means that you don't need to implement decryption in the cipher.
However I believe that the first ciphers used in PGP, Bassomatic and IDEA,
had both encryption and decryption implementations.

This is more of an advantage with ciphers which have asymmetric speed
in one direction, but I don't think either of those early ciphers had
that property.

The second advantage of CFB relates to block padding.  It is easy and
natural in CFB to handle messages which are not a multiple of the cipher
block length (8 bytes for the early ciphers).  You simply truncate the
ciphertext so it is the same length as the plaintext, and apply the same
rule in reverse for decryption.

At the time, I don't think we were aware of an analogous technique
for CBC.  Most people then (and many now) pad the CBC message to a
multiple of 8 bytes, encrypt, and then remove the padding upon decryption.

Since then we have become aware of the "ciphertext stealing" technique
which lets you truncate CBC messages.  But it is a bit complicated, and
does not apply very readily to messages shorter than the block length.
Given these disadvantages, ciphertext stealing is not very widely used
for CBC encryption, rather padding is still used instead.

I think this may have been the reason that Phil chose CFB.  As for
the non-standard "sync" operation, I don't remember why he did that.
Probably it just seemed to be a natural way of handling CFB given his
understanding of its rationale in terms of the way it interfaced with
the underlying cipher.

Hal Finney

---

From: Mike Markowitz <[email-masked]>
Date: Wed, 30 Apr 2003 15:26:08 -0500

>CFB has two advantages over CBC that might have led to its choice.

Hal: While we're on the subject of CFB can you possibly share with us the 
argument
you used to convince NIST the method is good?

In http://cert.uni-stuttgart.de/archive/ietf-openpgp/1999/05/msg00005.html
you wrote:

"The "pseudo IV" we have now is hard to explain. I had to go to some 
lengths in
getting our FIPS 140 certification (a standard security certification) to show
that our way was just as good as the regular way."

Thanks.

-mjm