How does OFB (Output Feedback) mode work and what type of cipher does it create?

OFB turns a block cipher into a synchronous stream cipher by repeatedly encrypting the IV to generate a keystream, which is XOR'd with the plaintext.

* OFB encrypts its own output repeatedly to make a plaintext-independent keystream, XORed with the plaintext. *

Keystream generation:

$$\begin{aligned} S_0 &= IV \\ S_i &= E(K, S_{i-1}) && \text{(encrypt previous keystream block)} \\ C_i &= M_i \oplus S_i && \text{(XOR plaintext with keystream)} \end{aligned}$$

Key properties:

• The keystream is generated independently of the plaintext — it only depends on $K$ and $IV$
• Keystream can be pre-computed before the message arrives
• No error propagation: a bit error in $C_i$ only affects $M_i$ (one bit flipped), not subsequent blocks
• Encryption and decryption are identical operations (both just XOR with keystream)

Disadvantages:

• Not parallelizable (each keystream block depends on the previous one)
• Like all stream ciphers: provides no integrity — bit-flipping attacks are possible

Tip: OFB = "block cipher used as a keystream generator." The actual encryption is just XOR, like a stream cipher.

Go deeper:

• Block cipher mode of operation (Wikipedia) — OFB and CTR as ways to turn a block cipher into a stream cipher.