1 Definition and purpose
CFB mode, or Cipher Feedback mode, is a block cipher mode of operation that adapts a fixed-size block cipher for use on data that may arrive in smaller pieces than the cipher’s native block length. It is commonly described as a self-synchronizing stream cipher because the ciphertext influences future output in a feedback loop. This design makes it useful when encryption must begin before all data is available, or when the message is naturally processed as a stream.
1.1 Block cipher modes of operation
A block cipher encrypts only fixed-length blocks, such as 64 or 128 bits. Modes of operation define how that primitive is applied to longer messages. CFB is one such mode, alongside CBC, OFB, and CTR. Unlike some modes that require complete blocks of plaintext, CFB can operate on partial segments, which gives it flexibility for transport and interactive communication.
1.2 Self-synchronizing stream cipher behavior
In a self-synchronizing stream cipher, later output depends on a recent history of ciphertext rather than on a continuously maintained internal keystream state alone. If a few ciphertext units are lost or inserted, the process can recover after a short interval once enough correct ciphertext has been received again. In CFB, this recovery property comes from feeding the previous ciphertext back into the block cipher input.
1.3 Relationship to streaming data
CFB is well suited to streams because it can produce output incrementally. Data does not need to be buffered to the block size of the underlying cipher, and encryption may proceed as information becomes available. This feature made the mode attractive in systems that handled terminal sessions, network links, and other sequential channels.
2 Operation
CFB uses the block cipher’s encryption function to generate a value that is combined with plaintext or ciphertext segments. Although it is used for both directions of communication, encryption and decryption proceed differently in their use of the block cipher inputs.
2.1 Encryption process
During encryption, an initialization vector starts the chain. The cipher encrypts the current feedback register, and the result is combined with a plaintext segment to create ciphertext. That ciphertext segment is then inserted into the feedback register, replacing some or all of the older feedback data depending on the segment size.
2.1.1 Initialization vector usage
The initialization vector, or IV, provides the initial input to the feedback register. It must be chosen so that the first output segment does not repeat predictably across messages. In practice, the IV is usually transmitted with the ciphertext and need not remain secret, but it should be unique or at least nonrepeating for a given key.
2.1.2 Feedback mechanism
The feedback mechanism is the defining feature of the mode. After the block cipher encrypts the current register contents, the resulting block is treated as a keystream-like value. A portion of that value is combined with the plaintext segment, and the resulting ciphertext segment is shifted back into the register. This continuing loop links each stage of the process to the previous one.
2.2 Decryption process
Decryption does not use the block cipher’s decryption function in standard CFB. Instead, it repeats the same encryption of the feedback register and combines the result with the ciphertext segment to recover plaintext. Because the procedure mirrors encryption in this way, implementations often rely only on the encryption primitive.
2.2.1 Recovery of plaintext segments
To recover a plaintext segment, the receiver encrypts the current feedback register, then combines the relevant portion of that output with the received ciphertext segment. The same mathematical operation used in encryption undoes the cipher-text masking. Once the plaintext segment is obtained, the ciphertext segment is also fed into the register for the next step.
2.2.2 Use of the block cipher encryption function
The use of the encryption function in both directions is a practical advantage. Many block ciphers are optimized for encryption, and some implementations expose only that operation as a primitive. CFB therefore fits naturally into systems where a separate decryption routine would add complexity without changing the underlying mode behavior.
2.3 Segment sizes
CFB may operate on segments smaller than the block size. The segment length determines how much output is consumed at each step and how much ciphertext is fed back into the register. This choice affects throughput, synchronization behavior, and the granularity of processing.
2.3.1 Full-block CFB
In full-block CFB, the segment size equals the cipher block size. Each iteration processes one complete block of data, so the feedback register is updated with a full ciphertext block. This variant is straightforward and closely resembles other block-oriented modes, while still retaining CFB’s self-synchronizing nature.
2.3.2 Bit-level and byte-level variants
CFB is also defined for smaller units such as bits or bytes. These versions permit very fine-grained streaming, though they typically incur more overhead because the block cipher must be invoked for each small segment. Byte-oriented CFB became common in systems that handled character-based communication, while bit-level CFB supported highly granular transmission protocols.
3 Mathematical description
The mode can be described in compact algebraic terms. Let the block cipher encryption function be applied to a register, and let part of the output be combined with a message segment by an exclusive-or operation. The register is then updated with ciphertext for the next iteration.
3.1 Input and output variables
Typical descriptions use an initialization vector, a key, a feedback register, plaintext segments, ciphertext segments, and an output derived from encrypting the register. The register has the same length as the block size of the underlying cipher. The segment size, often denoted by s, may be smaller than the full block length.
3.2 Iterative encryption steps
At each step, the cipher encrypts the current register value. A segment of the resulting block is selected and combined with the current plaintext segment to produce ciphertext. The register is then shifted and extended with that ciphertext segment. Repeating this process yields a chain of dependent segments.
3.3 Ciphertext propagation
Because each ciphertext segment is inserted back into the register, it affects future output. This propagation means that a change in one ciphertext segment alters the next several generated segments until the changed value has moved out of the feedback register. The exact extent of the effect depends on the segment size and the block length.
4 Properties
CFB has several practical properties that distinguish it from other modes. Some are beneficial for streaming, while others influence error behavior and implementation cost.
4.1 Padding requirements
One advantage of CFB is that it does not require padding in the same way as modes that encrypt only complete blocks of plaintext. Since it can operate on partial segments, the final portion of a message can be processed without extending it to the full block size. This is especially convenient when message lengths are irregular.
4.2 Error propagation
Bit errors in transmitted ciphertext affect plaintext recovery in a limited but noticeable way. A corrupted ciphertext segment typically alters the corresponding plaintext segment and also disturbs some subsequent output until the feedback register is refreshed by later correct ciphertext. This behavior is more localized than in some chaining modes, though the precise pattern depends on the chosen segment size.
4.3 Self-synchronization
If synchronization is lost due to missing or inserted ciphertext segments, CFB can recover after a finite amount of correct ciphertext has been processed. The receiver’s state is rebuilt from the incoming ciphertext stream as the register fills with valid data. This trait made the mode valuable in noisy channels and older serial communications.
4.4 Performance characteristics
CFB is generally less parallelizable than modes such as CTR because each step depends on the previous ciphertext. Small segment sizes also increase the number of block cipher invocations, which can reduce throughput. On the other hand, its incremental behavior and lack of padding can simplify certain applications.
5 Security considerations
CFB provides confidentiality when used correctly, but it has several operational requirements that matter for secure deployment. Its security depends on proper IV handling, on the unpredictability of the keystream-like output, and on protection against message tampering.
5.1 IV requirements
The IV should be unique for a given key and preferably unpredictable, especially in settings where repeated messages could reveal patterns. Reusing an IV with the same key can expose relationships between messages and weaken confidentiality. Since the IV is part of the mode’s initial state, poor IV selection can undermine the benefits of the feedback process.
5.2 Malleability
Like many confidentiality-only modes, CFB is malleable. An attacker who modifies ciphertext can cause controlled changes in the decrypted plaintext, even without knowing the key. For this reason, CFB is often paired with authentication mechanisms when message integrity is required.
5.3 Comparison with other modes
CFB is often compared with CBC, OFB, and CTR because these modes also adapt block ciphers for broader use. The differences lie in feedback direction, decryption behavior, and suitability for various transmission patterns.
5.3.1 CBC mode
CBC chains plaintext blocks into the encryption process. In contrast, CFB chains ciphertext and uses the block cipher’s encryption function on the feedback state. CBC generally operates on full blocks and requires padding, while CFB can handle smaller segments more naturally.
5.3.2 OFB mode
OFB generates a keystream by repeatedly encrypting its internal state, but the feedback comes from the previous keystream block rather than from ciphertext. This means OFB is not self-synchronizing in the same way CFB is. It also differs in error behavior, since ciphertext corruption in OFB affects only the corresponding plaintext bits.
5.3.3 CTR mode
CTR mode turns a block cipher into a counter-based keystream generator. It is highly parallelizable and does not depend on previous ciphertext. CFB is less parallel but has the self-synchronizing property that CTR lacks. As a result, the two modes serve different design goals.
6 Applications
CFB has appeared in many practical systems, especially where data was processed serially or where a block cipher had to function in a stream-like role. Its historical importance is tied to communication software and legacy cryptographic designs.
6.1 Legacy cryptographic systems
Older systems often adopted CFB because it could work with existing block ciphers without redesigning hardware or software around a different primitive. Its ability to handle partial blocks and its tolerance for incremental input made it attractive in early network and terminal applications.
6.2 Streaming communications
CFB is suitable for live data transmission, including interactive sessions and streaming channels. Because it can begin output quickly and proceed segment by segment, it fits environments where data should be encrypted as soon as it arrives. This usage aligns with its self-synchronizing nature.
6.3 Compatibility with existing block ciphers
The mode can be paired with many standard block ciphers, which made it a convenient extension mechanism. Systems that already implemented a block cipher could add CFB with comparatively modest changes. This compatibility helped it gain a place in numerous protocols and libraries.
7 Standards and implementations
CFB has been specified in various cryptographic standards and incorporated into widely used software libraries. Its exact details, such as segment size and IV handling, are often defined by the broader system that adopts it.
7.1 Specification references
Standards documents have historically described CFB as a mode for applying block ciphers to data streams and partial blocks. These specifications define the feedback process, segment size options, and initialization requirements. They also establish terminology that later implementations generally follow.
7.2 Common library support
Many cryptographic libraries expose CFB as one of several selectable block cipher modes. Support may vary in how segment sizes are configured, with some libraries offering only full-block CFB and others allowing byte-oriented variants. In practice, library support reflects the needs of compatibility and legacy interoperability.
7.3 Historical use in protocols
CFB has been used in older protocols and transport systems where message sizes were not fixed in advance. It was especially common in contexts that valued continuous processing and compatibility with limited computing resources. Although newer designs often prefer modes with better parallel performance or built-in authentication pairings, CFB remains a recognized and standardized mode.