Decrypt simple CBC with XOR

Question

I have searched and my problem is exactly the same as shown here:

Decrypt simple CBC message with known IV using XOR encryption

However, when I implement the solution it doesn't work, neither does my own solution.
I will restate the problem:

I've been given a ciphertext message, encrypted using CBC. I know that the block size is 12 bytes and I know the plaintext value of the first block.

I also know that the encryption function is a simple XOR:

Ci=K⊕(Mi⊕Ci−1) where C0=IV.

My (incorrect) solutions, programmed in Java:

Terminology:
"encrypted" is a byte-array holding the ciphertext
"decrypted" is a byte-array holding the recovered plaintext (decrypted cipher)
"first_block" is a byte-array holding the decrypted first block (which is the IV)
"key" is a byte-array, which will hold the key after it is recovered
^ is the java expression for XOR

The IV is known

attempt 1, using my own imagination:

// corresponds to K = IV (+) C0, where C0 = K (+) IV  

for (int i = 0; i < 12; i++)  
    key[i] = (byte) (first_block[i] ^ encrypted[i]);   

// corresponds to K (+) Ci (+) Ci-1 

for (int i = 12; i < 24; i++)  
    decrypted[i] = (byte) (key[i-12] ^ encrypted[i] ^ encrypted[i-12]);   

Result: I decrypt the first block of twelve, which is the IV that I already know, but the second block is just gibberish

attempt 2, using the information gotten from the previous question linked above copied:

//K = C0 + C1 + M1

byte[] key = new byte[12];
for (int i = 0; i < 12; i++)
    key[i] = (byte) (encrypted[i] ^ encrypted[i+12] + first_block[i]); 

// Mi = K + Ci + Ci-1
byte[] decrypted = new byte[encrypted.length]; 

for (int i = 12; i < 24; i++)
    decrypted[i] = (byte) (key[i-12] ^ encrypted[i] ^ encrypted[i-12]); 

Result: Still just gibberish, but different gibberish that I got above

What I'm looking for: Any kind of help

Answer 1

So, you are dealing with CBC decryption:
(image from Wikipedia)

What you want to do, is firstly to compute the key $K$ used by the block cipher at hand, since yours is a plain XOR, you can compute the key by XORing the ciphertext, the IV and the plaintext: $$K=C_0\oplus M_0 \oplus IV$$

Next, once you've got your key, you can apply the CBC decryption, by XORing the key with the ciphertext block at hand and XORing the result with the previous ciphertext block to get the current plaintext: $$M_i=C_{i}\oplus K \oplus C_{i-1}$$

Now, I do not see the whole code, but it seems strange that the IV is given as the first plaintext block.

If you were given: 1 block of known plaintext, 1 block of IV and 2 blocks of ciphertext, then you would be able to decrypt the second block of the ciphertext using the method I described above...

But there is something strange with your statement:

"first_block" is a byte-array holding the decrypted first block (which is the IV)

So, the decryption of the first block is the IV? Are you sure? Because this amount to having a all 0s first plaintext block then you have that: $$C_2 = (K\oplus IV) \oplus (M_2 \oplus K) = IV \oplus M_2$$ and so have a second block which is just an XOR of the IV and the second block plaintext, which defeats the purpose of CBC mode.

Which means you could simply decrypt your second block by XORing the second ciphertext block with the IV, since the key already canceled out, and the "chaining" doesn't apply because the first message is all 0s.

Notice that anyway, doing CBC mode with an XOR with a fixed key $K$ as an block cipher actually cancels the key $K$ for all odd blocks: $$\begin{aligned} C_0 &= K \oplus M_0 \oplus IV \\ C_1 &= K \oplus M_1 \oplus C_0 = K \oplus M_1 \oplus K \oplus M_0 \oplus IV = M_1 \oplus M_0 \oplus IV \\ C_2 &= K \oplus M_2 \oplus C_1 =K \oplus M_2 \oplus M_1 \oplus M_0 \oplus IV \\ C_3 &= K \oplus M_3 \oplus C_2 = M_3 \oplus M_2 \oplus M_1 \oplus M_0 \oplus IV \\ \cdots \end{aligned}$$

This can also help you.