Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for different approaches to proofs for the security of CBC mode encryption. What are the best sources of information about this subject?

share|improve this question
I believe that Katz and Lindell's Introduction has a formal proof contained therein, or at least contains a reference to one. Sadly, I don't have my copy with me at the moment. I did find these lecture notes which contain a rough sketch of a proof, though. Here is another set of lecture notes that also proves CBC mode is IND-CPA secure, but I haven't verified their argument myself. – Reid Nov 6 '13 at 19:55
Katz and Lindell refer to the 1997 paper by Bellare et al. – Dmitry Khovratovich Nov 6 '13 at 22:35
up vote 4 down vote accepted

The classic proof is contained in (1997), but it is not quite easy.

share|improve this answer

Here's a nice paper I came across a while ago: Wooding, Mark (2008), "New proofs for old modes", Cryptology ePrint Archive, report 2008/121:

"Abstract: We study the standard block cipher modes of operation: CBC, CFB, and OFB and analyse their security. We don't look at ECB other than briefly to note its insecurity, and we have no new results on counter mode. Our results improve over those previously published in that (a) our bounds are better, (b) our proofs are shorter and easier, (c) the proofs correct errors we discovered in previous work, or some combination of these. We provide a new security notion for symmetric encryption which turns out to be rather useful when analysing block cipher modes. Finally, we pay attention to different methods for selecting initialization vectors for the block cipher modes, and prove security for a number of different selection policies. In particular, we introduce the concept of a `generalized counter', and prove that generalized counters suffice for security in (full-width) CFB and OFB modes and that generalized counters encrypted using the block cipher (with the same key) suffice for all three modes. "

share|improve this answer
Thank you very much. – Dingo13 Nov 9 '13 at 9:36

If you can go through these lecture notes by Goldwaser and Bellare you will get the point

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.