# Tag Info

5

Absolutely. The key point is that, whilst in CBC mode, the encryption can be thought of as using the previous ciphertext as the IV - have a look at this diagram from wikipedia: I assume from what you've said that you have a function that will "do" AES-CBC decryption on large amounts of data, and you wish to use this. So, you simply run:  D_k^{IV}(c_1\ ...

4

Well, there is no really good way; the encryption of the plaintext is $E_k( Plaintext \oplus IV)$ (followed by 16 bytes which are a deterministic function of the first ciphertext block). The AES function $E_k$ is designed to be totally unpredictable if you don't know the key, there's nothing to leverage there. The only thing that allows you to gain any ...

4

Yes. Assume that the attacker knows the ciphertext $c = c_1 \mathbin\| c_2$, the initialization vector $v$ and the plaintext $m = m_1 \mathbin\| m_2$. This tells them that $D_k(c_1) = m_1 \oplus v$ and $D_k(c_2) = m_2 \oplus c_1$, where $D_k(\cdot)$ denotes block cipher decryption under the (unknown) key $k$. In particular, this implies that, if the ...

1

You do not mention any authentication of the ciphertexts. $\:$ If you could change the IV (which sounds highly unlikely) then you could make rather precise changes to the plaintext (as if it was a stream cipher). Ideally from your point of view, there may be a padding oracle attack (which I don't understand and so won't describe here). If you can change ...

1

It looks like what you are describing is comparable to IGE (Infinite Garble Extension) and especially biIGE mode of encryption. So I guess my question and the answer on my question here is of relevance.

1

You need to use different IV for every message you encrypt. Thus rather than the process: encrypt plaintext reverse the ciphertext continue encrypting (now from finish to start) You need to generate IV each time. I.e.: generate IV encrypt the plaintext using the IV store/send the ciphertext and the materials required to recreate IV The ...

Only top voted, non community-wiki answers of a minimum length are eligible