# What are the advantages of CBC over ECB?

From this question I understand that, for a block cipher, using CBC is better than ECB. It seems that if one only has part of the cipher text, then decryption is difficult because the decryption depends on the previous cipher block.

But, what if one does have the whole cipher text? Is CBC then better? It seems, that in this situation one can just first XOR each cipher block with the previous cipher block and then convert the cipher text into what would have been the output using ECB (I assume that the IV is known). Is that correct? If so, what other advantages does CBC have over ECB?

The reason why CBC is considered better than ECB has nothing to do with situations involving an attacker with a partial ciphertext; we always assume that any attacker has full access to the ciphertext.

Instead, the problem with ECB is that it leaks information. Specifically, if you encrypt two messages which has two blocks of plaintexts in common, then with ECB mode the corresponding ciphertext blocks will be the same. The attacker can see that, and can immediately deduce the relationship between the plaintext blocks; even if this doesn't give him immediate information about what the plaintext block might be, it tells him something about the plaintext, and that something is more than what we'd like to give him.

This doesn't happen with CBC mode; the previous ciphertext block (or IV) is effectively random (and independent of the plaintext block), and so what is presented to the block cipher is an effectively random string; a collision there is no more likely than it would be if we were encrypting random blocks.

Here is a famous example of this; here is the original image, the image encrypted in ECB mode, and the image encrypted in CBC mode:

As you can see, you can still visually see the image in the ECB mode encryption (it helps that the image is a cartoon, and so there are large areas with the exact same color); you can't see anything in the CBC mode encryption.

Now, if we were encrypting random blocks of data, it turns out ECB mode actually does work out; with random data, you are quite unlikely to run into the exact same block of data twice, and so this 'leaking when two blocks are the same' is not an issue. However, in the real world, we often encrypt things that are quite nonrandom; we need our cryptosystem to be able to deal with it.

• Can't you just generate the second picture from the third? (assuming you know the block size and IV) I am not still sure that I understand. – Thomas Dec 22 '13 at 4:08
• @Thomas: no, you cannot generate the second picture from the third. If you were thinking about somehow undoing the xor that's in CBC mode, remember that you do the xor and then you encrypt with the block cipher; that means, to undo the xor, you would need to decrypt first, and you can't do that unless you have the key. – poncho Dec 22 '13 at 4:10
• Arh... Ok, now I think I see it. I was thinking about the encryption as just being an XOR (or something else that commutes with XORing. In that case it wouldn't add anything, right?). Thanks for the answer. – Thomas Dec 22 '13 at 4:12
• Additionally, clever chosen-plaintext attacks against ECB can reveal plaintexts in $O(n)$. – Stephen Touset Aug 26 '14 at 17:33