0
$\begingroup$

As I understand, diffusion property in AES-CBC ensures that one-bit change in plaintext will yield changes in all following blocks in ciphertext upon encryption.

I'm looking for algorithm that will have this property on ciphertext. I.e. when I change one bit in ciphertext, then plaintext after decryption will be changed in all following blocks. As far as I know, AES-CBC changes only two blocks upon decryption.

Does such a mode of operation exist? Or do I have false assumptions?

Improve this question
$\endgroup$
5
  • $\begingroup$ Why do you need this property? $\endgroup$
    – CodesInChaos
    Mar 13 '15 at 14:24
  • $\begingroup$ I want to verify if encrypted value was altered. And I mean verify in weak sense, I want to discard only obvious cases, for performance reasons, not to secure system. $\endgroup$
    – dhuCerbin
    Mar 13 '15 at 15:28
  • $\begingroup$ You might want to look into OCB. It provides verification in a "strong" sense (i.e., AEAD) with performance not too far off from CTR mode. See web.cs.ucdavis.edu/~rogaway/ocb/news for a portable optimized implementation and web.cs.ucdavis.edu/~rogaway/ocb/license.htm for license info (free in almost all cases). $\endgroup$
    – Seth
    Mar 13 '15 at 18:23
  • 2
    $\begingroup$ @dhuCerbin why not just add a checksum or authentication code to the message? $\endgroup$
    – Richie Frame
    Mar 14 '15 at 0:31
  • $\begingroup$ Listen to @RichieFrame. Use the right tool for the job — you're trying to hammer a square peg into a round hole. $\endgroup$
    – Stephen Touset
    Mar 14 '15 at 22:03
3
$\begingroup$

Yes, there are modes of operation that achieve the property that you are describing. For example, the Propagating Cipher Block Chaining (PCBC) mode of operation:

Propagating Cipher Block Chaining (PCBC) encryption Propagating Cipher Block Chaining (PCBC) decryption

This mode is similar to CBC but the output for each block is propagated to the input of the next one, so a small error will propagate indefinitely, both for encryption and decryption.

There may exist other less known modes of operation that also share this property.

Depending if you consider also corruption of the Initialization Vector (IV), then other common modes of operation will do. For instance, the Counter (CTR) mode and the Output Feedback (OFB) mode will irremissibly corrupt all the plaintext blocks during decryption if the IV is changed.

Improve this answer
$\endgroup$
2
  • $\begingroup$ But trying to use this as a MAC doesn't work - for example truncation attacks are trivial in a known-plaintext scenario. $\endgroup$
    – CodesInChaos
    Mar 14 '15 at 13:47
  • $\begingroup$ It's worth pointing out that incidental changes to the ciphertext will change the output of all all subsequent plaintext blocks. But the same is not true in the presence of adversarial changes to the ciphertext. For example, the effect of swapping ciphertext blocks does not propagate to all subsequent plaintext blocks. $\endgroup$
    – Mikero
    yesterday

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.