Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a hypothetical encryption scheme where somebody uses the one-time pad in CBC mode. That is, the block cipher is $E(k, m) :=k⊕m$, and that block cipher is used in CBC mode.

Now, I am assuming that a message $m=m_1||m_2||m_3||m_4$ is used for encryption.

How to compute $m_3⊕m_4$ from the resulting ciphertext (without using the key)?

Also: using this, how can I prove that it is IND_CPA insecure?

share|improve this question
up vote 3 down vote accepted

Remark: in One Time Pad the pad is used once, thus this is not OTP, since here $k$ is reused.

Hint for part 1: Write the relations between $k$, the message blocks $m_i$, the ciphertext blocks $\small C_i$ with the convention $\small\text{IV}=\small C_0$. Then, find equations that allow computing the desired $m_3⊕m_4$ from known quantities.

Hint for part 2, textbook variant: What is the definition that a cipher is not IND-CPA secure? Exhibit whatever that asks.

Hint for part 2, shortcut variant: IND-CPA implies that, for random plaintext, nothing can be learned about the plaintext given the ciphertext.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.