Editing Block cipher mode of operation (section)

===={{Anchor|OFB}}Output feedback (OFB)====
{{Infobox
|name         = 
|bodystyle    = 
|title        = 
|titlestyle   = 
|image        = 
|imagestyle   = 
|caption      = 
|captionstyle = 
|headerstyle  = background:#ccf;
|labelstyle   = background:#ddf;
|datastyle    =

|header1 = OFB
|label1  = 
|data1   = 
|header2 = 
|label2  = 
|data2   = Output feedback
|header3 = 
|label3  = Encryption parallelizable
|data3   = No
|header4 = 
|label4  = Decryption parallelizable
|data4   = No
|header5 = 
|label5  = Random read access
|data5   = No

|belowstyle = background:#ddf;
|below = 
}}
The ''output feedback'' (OFB) mode makes a block cipher into a synchronous [[stream cipher]].  It generates [[keystream]] blocks, which are then [[XOR]]ed with the plaintext blocks to get the ciphertext.  Just as with other stream ciphers, flipping a bit in the ciphertext produces a flipped bit in the plaintext at the same location.  This property allows many [[error-correcting code]]s to function normally even when applied before encryption.

Because of the symmetry of the XOR operation, encryption and decryption are exactly the same:
: <math>C_j = P_j \oplus O_j,</math>
: <math>P_j = C_j \oplus O_j,</math>
: <math>O_j = E_K(I_j),</math>
: <math>I_j = O_{j-1},</math>
: <math>I_0 = \text{IV}.</math>


{{multiple image
| header = Output feedback (OFB)
| align = center
| direction = vertical
| image1 = OFB encryption.svg
| caption1 = OFB mode encryption
| image2 = OFB decryption.svg
| caption2 = OFB mode decryption
| width = 512
}}


Each output feedback block cipher operation depends on all previous ones, and so cannot be performed in parallel.  However, because the plaintext or ciphertext is only used for the final XOR, the block cipher operations may be performed in advance, allowing the final step to be performed in parallel once the plaintext or ciphertext is available.

It is possible to obtain an OFB mode keystream by using CBC mode with a constant string of zeroes as input. This can be useful, because it allows the usage of fast hardware implementations of CBC mode for OFB mode encryption.

Using OFB mode with a partial block as feedback like CFB mode reduces the average cycle length by a factor of 2<sup>32</sup> or more. A mathematical model proposed by Davies and Parkin and substantiated by experimental results showed that only with full feedback an average cycle length near to the obtainable maximum can be achieved. For this reason, support for truncated feedback was removed from the specification of OFB.<ref>{{cite book |first1=D. W. |last1=Davies |first2=G. I. P. |last2=Parkin |chapter=The average cycle size of the key stream in output feedback encipherment |title=Advances in Cryptology, Proceedings of CRYPTO 82 |pages=263–282 |year=1983 |location=New York |publisher=Plenum Press |isbn=0306413663 }}</ref>