Editing Block cipher mode of operation (section)

===== CFB-1, CFB-8, CFB-64, CFB-128, etc. =====
NIST SP800-38A defines CFB with a bit-width.<ref name="AESBlockDocumentation">{{cite journal |url=http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf |title=SP 800-38A, Recommendation for Block Cipher Modes of Operation: Methods and Techniques |first=Author: Morris Dworkin |last=(NIST) |website=csrc.nist.gov |year=2001 |doi=10.6028/NIST.SP.800-38A |access-date=28 April 2018 |url-status=live |archive-url=https://web.archive.org/web/20170828210645/http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf |archive-date=28 August 2017|doi-access=free }}</ref> ''The CFB mode also requires an integer parameter, denoted s, such that 1 ≤ s ≤ b.  In the specification of the CFB mode below, each plaintext segment (Pj) and ciphertext segment (Cj) consists of s bits. The value of s is sometimes incorporated into the name of the mode, e.g., the 1-bit CFB mode, the 8-bit CFB mode, the 64-bit CFB mode, or the 128-bit CFB mode.''

These modes will truncate the output of the underlying block cipher.
: <math>I_0 = \text{IV}.</math>
: <math>I_i = \big((I_{i-1} \ll s) + C_i\big) \bmod 2^b,</math>
: <math>C_i = \operatorname{MSB}_s\big(E_K(I_{i-1})\big) \oplus P_i,</math>
: <math>P_i = \operatorname{MSB}_s\big(E_K(I_{i-1})\big) \oplus C_i,</math>

CFB-1 is considered self synchronizing and resilient to loss of ciphertext; "When the 1-bit CFB mode is used, then the synchronization is automatically restored b+1 positions after the inserted or deleted bit. For other values of s in the CFB mode, and for the other confidentiality modes in this recommendation, the synchronization must be restored externally." (NIST SP800-38A). I.e. 1-bit loss in a 128-bit-wide block cipher like AES will render 129 invalid bits before emitting valid bits.

CFB may also self synchronize in some special cases other than those specified. For example, a one bit change in CFB-128 with an underlying 128 bit block cipher, will re-synchronize after two blocks. (However, CFB-128 etc. will not handle bit loss gracefully; a one-bit loss will cause the decryptor to lose alignment with the encryptor)