Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Is error propagation in DES PCBC a good method to prevent decryption/crypt analysis by third parties?

If I had a very large file encrypted with Perl's DES with the PCBC option, and then removed the first megabyte of the resulting ciphertext would this render the remaining ciphertext 100% immune to crypt analysis ? Why or why not? Suppose that the missing 1 megabyte file disappeared forever would the ciphertext never be able to be decrypted? I'm assuming that too much information is being lost by not having the first megabyte of the ciphertext for it ever to be decrypted or any further information about the plaintext to be discovered.

What if the data was encrypted first in AES-CBC for more protection and then re-encrypted with DES PCBC for the intended error propagation? Could this weaken it or would it strengthen it slightly?

I am considering using the PERL DES cipher with the PCBC option since this seems to be the easiest and fastest way to implement this.

share|improve this question
First off, DES should be considered utterly broken for all modern purposes. The keys are trivially brute-forceable given computing power nowadays. –  Stephen Touset Mar 27 '14 at 23:19
This is true, I'd prefer an AES-PCBC implementation but I can only find DES. My thought is the weakness of the keys doesn't really matter though if error propagation has already made the rest of the cipher text worthless to attackers. –  user12737 Mar 27 '14 at 23:25
Using strong, modern encryption algorithms defeats cryptanalysis. If the algorithms we had today couldn't withstand cryptanalysis, we would replace them! –  Stephen Touset Mar 27 '14 at 23:47
As I mention in my common on Richie's post, PCBC does not have the property you think it does. If any two consecutive blocks are known, given a break in the underlying algorithm, an attacker would recover the XOR or the corresponding plaintexts. You appear to want an all-or-nothing transform. –  Stephen Touset Mar 28 '14 at 6:51
But the problem with trying to protect against "future cryptanalysis methods" is that we fundamentally have no idea what they will be. Modern ciphers protect against all of the threats we know about (and hopefully many we don't); if there was something simple to do that cryptographers believed would increase security against attackers for the next 100 years, it would already be baked in. –  Stephen Touset Mar 28 '14 at 6:52

1 Answer 1

up vote 1 down vote accepted

This is actually a good question, about how a mode of operation will affect analysis of a data stream.

In regards to an implementation of AES-PCBC, if you have AES-ECB you can build a wrapper for PCBC around it with the appropriate block size. It is not too difficult, but unnecessary...

In regards to security analysis, PCBC is no more resistant than CBC with an unknown Initialization Vector, since upon decryption the only difference between the modes is that the previous block input is only 1 value.

enter image description here

This will make decryption slower since it can not be decoded in parallel, but brute forcing the key space CAN be done in parallel. Once the correct combination of mode input and key are found, the entire remaining data stream will be correctly decrypted. The brute force of the IV/prior block is faster than the key, since no key change is required. DES is a 64-bit block, which means it has a small IV, and that makes your Key/IV search combination theoretically feasible with appropriate hardware (not now, but in the future yes).

The error propagation aspect of the mode was desired before widespread use of message authentication codes, modern cryptography sees error propagation through a mode as unnecessary. There are other applications that may prefer error propagation, but data at rest is not one of them. The downsides of error propagating modes (mostly performance) do not make up for any perceived advantage in security.

A bad mode is bad, but a good mode does not make a good cipher any better, and DES just isn't good enough anymore.

share|improve this answer
Given two consecutive ciphertext blocks $c_{i}, c_{i+1}$ a break of the cipher would allow the attacker to recover $p_{i} \oplus p_{i+1}$ which more or less means the (remaining) plaintext is still recoverable. –  Stephen Touset Mar 28 '14 at 6:42
Yes, assuming the attacker knows what the plaintext is. It is at least still a harder workload than CBC, which for DES is very important –  Richie Frame Mar 28 '14 at 8:23
I see, that makes a lot of sense. So, even if I chopped off the first block to create error propagation you could still brute force what the next block would be expecting. This basically doesn't give any more protection than not having the IV available to the attacker like Richie said. Thanks for explaining. –  user12737 Mar 28 '14 at 8:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.