Suppose that X = (x1, . . . , xn) and X' = (x'1, . . . , x'n) are two sequences of n plaintext blocks. Suppose X and X' are encrypted in OFB mode using the same key and the same IV, and in CTR mode with the same counter.
Is it computationally easy for an adversary to compute X ⊕ X'?
Note that if this is true, then reusing an IV or counter without changing the key opens us up to the same flaws as reusing a keystream in a OTP.
A. True for both OFB and CTR modes
B. True for OFB and False for CTR
C. False for OFB and True for CTR
D. False for both.