OFB Mode Encryption-Decryption Symmetry

Updated 19 Sep 2026

•
What it is
- •
  OFB (like CTR/CFB) generates a keystream from the key and IV alone, independent of the plaintext, and XORs it in — making encryption and decryption literally the same operation. If an attacker can get arbitrary data encrypted under the exact IV a secret was originally encrypted with, feeding that secret's ciphertext back through "encrypt" reproduces the original plaintext.
•
When to apply
- •
  An oracle exposes an "encrypt with chosen plaintext and IV" endpoint, plus a separately generated OFB/CTR-encrypted secret whose IV is revealed (often prepended to its ciphertext) — reusing that IV cancels the keystream.
•
Math
- •
  $keystream = E_K(IV); c = p \oplus keystream \Rightarrow encrypt(c, IV) = c \oplus keystream = p$ .

Python

recovered_plaintext = encrypt_oracle(secret_ciphertext, secret_iv)

•
Related
- •
  Known-Plaintext Keystream Recovery (Many-Time Pad)
•
Cards
- •
  Why are OFB encryption and decryption the same operation?
  - •
    Both just XOR the data with a keystream derived from the key and IV alone; XOR is self-inverse.
- •
  What do you need control over to exploit OFB's symmetry via an encrypt oracle?
  - •
    The ability to encrypt chosen data under the exact same IV the secret was encrypted with.
•
Worked example
- •
  With one-byte plaintext $0x41$ and keystream $0x9a$ , OFB encryption gives $c=0xdb$ . Applying the same keystream again gives $0xdb\oplus0x9a=0x41$ . The property requires the same key, IV, and starting position.