I've read the CBC-R description from Rizzo & Duong but am having trouble understanding the sequence of steps that would be taken when the IV is unknown and is not included with the ciphertext.
Suppose I want to send a two-block ciphertext such that block 1 decrypts to garbage and block 2 decrypts to my desired plaintext. Would the following work? If so, why not?
- Pick a desired plaintext, call this P
- Create a random block, call this R1
- Send the random block to a padding oracle decryption routine, call the result D1
- XOR D1 with P, and make this block 1
- Use R1 as block 2
Since the IV is unknown the first block becomes garbage, but the during decryption the next block should decrypt R1, yielding D1, then XOR it with my block 1 to get back to my desired plaintext. Am I looking at this correctly?
Side question: I assume plaintext (step 1) should include any padding sequence that the server expects, e.g. PKCS#7. Or should this be somehow applied during step 5?