# CBC not CCA secure

I always get stuck at those kind of exercises in my Cryptography class. I just don't understand how should I build these scenarios of "sending m1 and m2 and then somehow telling if it was m1 or m2 etc..." attacks. Can someone explain to me in simple terms how can I describe a scenario for this exercise: "Show that the CBC mode is not CCA-secure by describing an attacker A and name its advantage."

And please any Book suggestions to learn those attacks, because I understand the theory, but when it comes to practice, I get stuck.

• Suggestions for this kind of exercise: 1) Write down the definitions you work with (here, of CCA-secure, and of CBC mode); it's strongly suggested that you edit the question with that. 2) Meanwhile, make sure to use consistent notation (e.g. here, it's probably best to make the Initialization Vector part of the ciphertext so that CBC encryption matches the formalism of the CCA experiment). 3) If that does not impair the desired proof, go for the simplest (here: restricting to the less block of plaintext that make sense, e.g. one block).
– fgrieu
Commented May 15, 2023 at 6:34
• @fgrieu thank you:) Can you suggest me any site/book where I can practice these kind of attacks? Commented May 15, 2023 at 12:22
• The definitions you should use are those in your class, because the level of formalism and the notations vary. For CCA, the problem statement most likely is about CCA2, which is explained here (I say so because CBC is CCA1-secure). For CBC, any text source that makes IV the first block of ciphertext will do, e.g. the HAC's drawing and alg 7.13. The proof itself would have a structure similar to this (but I wish I had a better example).
– fgrieu
Commented May 15, 2023 at 13:48
• This answer could also help; at least, it contains a definition of IND-CCA2.
– fgrieu
Commented May 15, 2023 at 17:35

The CPA security game involves guessing which of m1 and m2 the encryption oracle encrypted and returned as a challenge. Adversary picks both messages. They win if they do better than 50:50 random guessing. In simple terms, this means the adversary can distinguish between messages after they're encrypted.

CCA is the same but gives access to a decryption oracle that decrypts anything but the challenge value. Challenge values are obviously blacklisted or the adversary just asks for a decryption and then they know whether it was m1 or m2 and win trivially. CCA insecurity means the attacker can learn information about one encrypted message by decrypting another different chosen ciphertext.

CBC is malleable

• bit flips in the IV flip bits in the first plaintext block
• bit flips in ciphertext flip bits in the next plaintext block and randomise that plaintext block

So the attacker can decrypt blacklisted messages by flipping one of the IV bits, submitting that to the decryption oracle, and flipping the same bit in the first block of whatever comes back. This gets them around the blacklist and wins the game with 100% probability. The attacker has learned the challenge ciphertext by decrypting a related message.

In real applications malleability has real consequences, attackers can flip bits in the first block for free and the nth block at the cost of trashing the (n-1)th block.

• thank you for the clarification. (sorry for the late reply) Commented May 22, 2023 at 11:17