I've implemented this algorithm which, working from the end of the message backwards, creates a valid CBC ciphertext from any plaintext, using the block cipher's decryption operation instead of the encryption operation.

I bet this is described in the literature, somewhere. Possibly as a bad idea.

My questions:

1. What is this method/algorithm/construction called?
2. Is it as secure as CBC implemented the normal way?
3. Do the normal rules for CBC IV apply to the last ciphertext block or not?

For those wondering why I would want to encrypt my message from the end, this is an exercise in exploiting a padding oracle attack (against my own dummy code running on my own server).

I've implemented this algorithm, which, working from the end of the message backwards, creates a valid CBC ciphertext from any plaintext, using the block cipher's decryption operation instead of the encryption operation.

I bet this is described in the literature, somewhere. Possibly as a bad idea.

My questions:

1. What is this method/algorithm/construction called?
2. Is it as secure as CBC implemented the normal way?
3. Do the normal rules for CBC IV apply to the last ciphertext block or not?

For those wondering why I would want to encrypt my message from the end, this is an exercise in exploiting a padding oracle attack (against my own dummy code running on my own server).