Quiz Entry - updated: 2026.07.14
How does error propagation differ across the block cipher modes ECB, CBC, OFB, and CTR?
ECB and OFB/CTR have minimal error propagation (only the affected block/bit), while CBC propagates errors across two blocks.
Error propagation comparison:
| Mode | Bit error in C_i affects... |
|---|---|
| ECB | M_i is garbled (only that block) |
| CBC | M_i is garbled completely + exactly one bit flipped in M_{i+1} |
| OFB | Only the corresponding bit in M_i is flipped |
| CTR | Only the corresponding bit in M_i is flipped |
Why this matters:
- CBC is self-recovering: after 2 blocks, decryption is back to normal
- OFB/CTR have the cleanest error behavior but also the worst integrity problem (bit-flip attacks are trivial)
- ECB errors are contained but the mode itself is insecure for other reasons
Lost block (synchronization loss):
- ECB: Only one block lost
- CBC: Two blocks affected, then recovery
- OFB: All subsequent blocks are garbled (loss of synchronization is fatal)
- CTR: Only the lost block is affected (counter is independent)