Subject: Low-level question about OpenPGP - why CFB mode?

From: [email-masked]
Date: Wed, 30 Apr 2003 13:54:16 -0500

Why does OpenPGP use a custom CFB mode instead of CBC mode?  CFB with the
slide equal to the blocksize is basically different from CBC in that the
encryption is done before combining, rather than after.

I presume its simply always been that way, and it's not a problem so it was
never changed in an update.  But why was that chosen initially, if anybody
knows, and are there any propblems with CBC that this avoids?

--John

---

From: Derek Atkins <[email-masked]>
Date: 30 Apr 2003 16:05:49 -0400

One benefit of using CFB is that you don't need to pad your plaintext.
As for why it was chosen...  I think that answer is probably lost in
the mystery of time (read: it was like that in PGP 2.0 and nobody had
a good reason to change it).

-derek

-- 
       Derek Atkins
       Computer and Internet Security Consultant
       [email-masked]             www.ihtfp.com

---

From: Jon Callas <[email-masked]>
Date: Wed, 30 Apr 2003 15:59:59 -0700

> knows, and are there any propblems with CBC that this avoids?

It has, in fact, always been that way.

The reason is that CFB mode doesn't require padding.

The resync is there so you can easily tell if you have (most likely -- 1 in
64K chance of a miss) decrypted properly with the right key.

The downside is that there are attacks on CFB mode that don't exist on CBC
mode. The Jallal/Katz/Schneier attack of last summer is really an attack on
CFB mode. It's possible there are interesting CBC attacks (one was published
at last year's Crypto), but no one's made anything practical with it yet.
(But heck, the JKS attack is almost impractical.)

    Jon