3
$\begingroup$

I have a hypothetical encryption scheme where somebody uses the one-time pad in CBC mode. That is, the block cipher is $E(k, m) :=k⊕m$, and that block cipher is used in CBC mode.

Now, I am assuming that a message $m=m_1||m_2||m_3||m_4$ is used for encryption.

How to compute $m_3⊕m_4$ from the resulting ciphertext (without using the key)?

Also: using this, how can I prove that it is IND_CPA insecure?

$\endgroup$
3
$\begingroup$

Remark: in One Time Pad the pad is used once, thus this is not OTP, since here $k$ is reused.

Hint for part 1: Write the relations between $k$, the message blocks $m_i$, the ciphertext blocks $\small C_i$ with the convention $\small\text{IV}=\small C_0$. Then, find equations that allow computing the desired $m_3⊕m_4$ from known quantities.

Hint for part 2, textbook variant: What is the definition that a cipher is not IND-CPA secure? Exhibit whatever that asks.

Hint for part 2, shortcut variant: IND-CPA implies that, for random plaintext, nothing can be learned about the plaintext given the ciphertext.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.