In Cipher Block Chaining (CBC) mode, each block of plaintext is XORed with the previous ciphertext block before being encrypted. What happens if I use the same IV instead of the previous ciphertext block? Is it vulnerable to chosen-plaintext attack?
$\begingroup$
$\endgroup$
4
-
5$\begingroup$ If you "use the same IV instead of previous ciphertext block?" it is not CBC mode. It is essentially ECB mode with a slight modification. If the same key is used blocks with identical plain text will have identical cypher text. $\endgroup$– zaphCommented Oct 20, 2018 at 10:48
-
1$\begingroup$ The Initialization Vector is something different than the previous ciphertext block. As the name indicates, the IV is only used at the start of the CBC calculation: the first plaintext block is XORed with it before it is fed into the block cipher. And actually it should not be a ciphertext block of a previous encrypted message, as it needs to be unpredictable (random) to an attacker. You are possibly describing a vector but not the initialization vector. $\endgroup$– Maarten Bodewes ♦Commented Oct 25, 2018 at 15:58
-
$\begingroup$ @MaartenBodewes Using the last ciphertext block of the previous message as IV for the next message will produce the same result as you would have achieved by encrypting the concatenation of the two cleartext messages in one go. Intuitively that sounds safe, but it isn't for the reasons you point out. That subtlety is something which has lead to vulnerabilities in the past. $\endgroup$– kasperdCommented Nov 1, 2018 at 14:20
-
$\begingroup$ @MaartenBodewes There is no flaw in your reasoning. I was merely pointing out why it's so easy to mistakenly believe you can use the last cipher block as IV for your next message. I don't see how my comment could be interpreted as saying it is secure. I clearly said it isn't safe and that it has lead to vulnerabilities in the past. $\endgroup$– kasperdCommented Nov 1, 2018 at 15:23
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
If the modification is done, the encryption looks like this:
$$C_i=E_K(\text{IV}\oplus P_i)$$
and assuming the "IV" is public, this is essentially ECB mode with a security-irrelevant pre-processing by XOR'ing a constant into the message.
Assuming the "IV" is non-public, this is essentially an XOR cipher encrypted with ECB mode and in particular this is still vulnerable to the standard ECB attack that you can detect repeated blocks, which means that the mode / construction can be broken under a standard (formal) ciphertext-only attack where the attacker-chosen messages are 2 blocks.
