Is error propagation in DES PCBC a good method to prevent decryption/crypt analysis by third parties?

If I had a very large file encrypted with Perl's DES with the PCBC option, and then removed the first megabyte of the resulting ciphertext would this render the remaining ciphertext 100% immune to crypt analysis ? Why or why not? Suppose that the missing 1 megabyte file disappeared forever would the ciphertext never be able to be decrypted? I'm assuming that too much information is being lost by not having the first megabyte of the ciphertext for it ever to be decrypted or any further information about the plaintext to be discovered.

What if the data was encrypted first in AES-CBC for more protection and then re-encrypted with DES PCBC for the intended error propagation? Could this weaken it or would it strengthen it slightly?

I am considering using the PERL DES cipher with the PCBC option since this seems to be the easiest and fastest way to implement this.

  • $\begingroup$ First off, DES should be considered utterly broken for all modern purposes. The keys are trivially brute-forceable given computing power nowadays. $\endgroup$ Mar 27 '14 at 23:19
  • $\begingroup$ This is true, I'd prefer an AES-PCBC implementation but I can only find DES. My thought is the weakness of the keys doesn't really matter though if error propagation has already made the rest of the cipher text worthless to attackers. $\endgroup$
    – user12737
    Mar 27 '14 at 23:25
  • 1
    $\begingroup$ Using strong, modern encryption algorithms defeats cryptanalysis. If the algorithms we had today couldn't withstand cryptanalysis, we would replace them! $\endgroup$ Mar 27 '14 at 23:47
  • 1
    $\begingroup$ As I mention in my common on Richie's post, PCBC does not have the property you think it does. If any two consecutive blocks are known, given a break in the underlying algorithm, an attacker would recover the XOR or the corresponding plaintexts. You appear to want an all-or-nothing transform. $\endgroup$ Mar 28 '14 at 6:51
  • 1
    $\begingroup$ But the problem with trying to protect against "future cryptanalysis methods" is that we fundamentally have no idea what they will be. Modern ciphers protect against all of the threats we know about (and hopefully many we don't); if there was something simple to do that cryptographers believed would increase security against attackers for the next 100 years, it would already be baked in. $\endgroup$ Mar 28 '14 at 6:52

This is actually a good question, about how a mode of operation will affect analysis of a data stream.

In regards to an implementation of AES-PCBC, if you have AES-ECB you can build a wrapper for PCBC around it with the appropriate block size. It is not too difficult, but unnecessary...

In regards to security analysis, PCBC is no more resistant than CBC with an unknown Initialization Vector, since upon decryption the only difference between the modes is that the previous block input is only 1 value.

enter image description here

This will make decryption slower since it can not be decoded in parallel, but brute forcing the key space CAN be done in parallel. Once the correct combination of mode input and key are found, the entire remaining data stream will be correctly decrypted. The brute force of the IV/prior block is faster than the key, since no key change is required. DES is a 64-bit block, which means it has a small IV, and that makes your Key/IV search combination theoretically feasible with appropriate hardware (not now, but in the future yes).

The error propagation aspect of the mode was desired before widespread use of message authentication codes, modern cryptography sees error propagation through a mode as unnecessary. There are other applications that may prefer error propagation, but data at rest is not one of them. The downsides of error propagating modes (mostly performance) do not make up for any perceived advantage in security.

A bad mode is bad, but a good mode does not make a good cipher any better, and DES just isn't good enough anymore.

  • $\begingroup$ Given two consecutive ciphertext blocks $c_{i}, c_{i+1}$ a break of the cipher would allow the attacker to recover $p_{i} \oplus p_{i+1}$ which more or less means the (remaining) plaintext is still recoverable. $\endgroup$ Mar 28 '14 at 6:42
  • $\begingroup$ Yes, assuming the attacker knows what the plaintext is. It is at least still a harder workload than CBC, which for DES is very important $\endgroup$ Mar 28 '14 at 8:23
  • $\begingroup$ I see, that makes a lot of sense. So, even if I chopped off the first block to create error propagation you could still brute force what the next block would be expecting. This basically doesn't give any more protection than not having the IV available to the attacker like Richie said. Thanks for explaining. $\endgroup$
    – user12737
    Mar 28 '14 at 8:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.