# One time pad in CBC mode?

I have been searching about if it is more secure to use CBC mode in OTP but I can't find anywhere where people have sad that it is more secure.

Question: Is CBC mode in OTP more secure?

Because I have been reading articles like "https://stackoverflow.com/questions/22212407/how-to-alter-cbc-encrypted-text-to-change-the-message" and I have been wondering if it makes OTP more secure on that attack.

For example, let say that you have a message: "100 dollars should be moved." and you encrypt it with OTP. Then everybody can just take the first character "1" and change it to a 9 by XOR the 1 from the cipher-text and then XOR a "9" with the key you got.

BUT if you have it in CBC mode does it make it safer from this kind of attacks? (Known-plaintext-attacks and chosen-plaintext-attacks).

• It is unclear from your question how that would even work. CBC mode is used to take a fixed length block cipher and turn it into something that can encrypt larger messages. OTP is infinite length. Are you suggesting dividing up the plaintext into chunks and propagating cipher text somehow? Perhaps some equations would be helpful. For example, say you divide the plaintext and the key stream into 128 bit chunks. Let $p_0$ be the first 128 bits of plaintext and $k_0$ be the first 128 bits of key stream. Then $c_0=p_0\oplus k_0$. Then for all $i>0$, $c_i=p_i\oplus k_i\oplus c_{i-1}$. – mikeazo May 26 '15 at 13:31
• Is that what you are proposing doing? – mikeazo May 26 '15 at 13:31
• My question is that does CBC make OTP more secure on know-plaintext-attacks and chosen-plaintext-attacks? – Stefan May 26 '15 at 13:33
• But how do you do CBC (which is for fixed length block ciphers) with OTP (which is an infinite length stream cipher)? – mikeazo May 26 '15 at 14:27
• The point @mikeazo is trying to make is that your question is nonsensical. It's like asking whether or not it's safer to have anti-lock brakes on a jet-ski. Just as anti-lock brakes only apply to wheeled vehicles, CBC mode only applies to block ciphers — but one-time pads are a form of stream cipher. The property you want to avoid is malleability, but this is not something CBC defends against as it is trivially malleable. You are looking for cryptographic authenticity. – Stephen Touset May 26 '15 at 19:45

## 4 Answers

For example, let say that you have a message: "100 dollars should be moved." and you encrypt it with OTP. Then everybody can just take the first character "1" and change it to a 9 by XOR the 1 from the cipher-text and then XOR a "9" with the key you got.

What you are describing is what happens if an attacker introduces changes in the ciphertext by a man-in-the-middle attack. This kind of attack is not protected against by OTP. OTP only provides for confidentiality, not integrity and authenticity. To add integrity and authenticity you need to add a message authentication code or MAC to the ciphertext.

Unfortunately MAC's won't provide perfect integrity or authenticity. In practice this doesn't matter much as - for instance - HMAC is pretty secure. It cannot be proven secure just like OTP however. Ciphers such as AES have the same properties; they are rather secure, but they cannot be proven secure. Generally they are considered secure enough and they are much more practical than OTPs.

OTP doesn't propagate errors introduced to the ciphertext. CBC does propagate errors. If you could reliably detect such errors then you would have integrity protection. This is however not the case:

• CBC error propagation is localized to the current block and a single bit of the next block;
• CBC decryption always succeeds, you just get incorrect plaintext;
• if the plaintext is a padded message then the padding may trigger padding errors, but it may also - by chance - create a valid padding scheme;
• if the plaintext is a padded message then plaintext/padding oracle attacks may apply, destroying not just the integrity but also the confidentiality (leaving you with no protection whatsoever).

Nowadays we don't care about error propagation all that much; we apply a (H)MAC over the IV and ciphertext or we apply an authenticated mode of operation (an AEAD cipher) such as GCM. In that case the verification of the authentication tag will fail if any changes are made to the IV, ciphertext or authentication tag.

The CBC mode of operation is defined for keyed block ciphers. OTP however isn't a block cipher, so CBC cannot be directly applied to it. In CBC the block cipher is executed for each block of plaintext. As you should never reuse the key for a one time pad, CBC can not be made applicable to OTP.

• I thought Carter-Wegman MACs were provably secure (in the sense that no attacker can forge one with probability greater than 1/2^(tag length), and subject to the same sorts of conditions as an OTP)? – cpast May 26 '15 at 21:08
• @cpast well, unless I'm very mistaken there are no tags of unlimited size. OTP puts the bar impossibly high in that regard. – Maarten Bodewes May 26 '15 at 21:44

Is CBC mode in OTP more secure?

No. If your one time pad satisfies the required properties (it's truly random, the attacker has no information about it, and it's only used once), then OTP already has perfect secrecy; playing around with how it works can't make things better.

If your one time pad doesn't satisfy the required properties, then all bets are off; playing around with CBC mode doesn't help.

• Ok but how can I stop known-plaintext-attacks and chosen-plaintext-attacks? – Stefan May 26 '15 at 13:39
• @Stefan: against a correctly implemented OTP, KPA's and CPA's are impossible. – poncho May 26 '15 at 13:41
• @Stefan: to add to what poncho says about impossibility. Correctly implemented OTP has a new pad every time. So, if I know the plaintext, I can get the pad, but that pad is never used again, so who cares. Same with CPA. – mikeazo May 26 '15 at 14:28
• This doesn't really answer the description in the first to last paragraph, but that's probably because that paragraph does describe neither known or chosen plaintext attacks. – Maarten Bodewes May 26 '15 at 21:47

Stream ciphers and some block cipher modes are particularly vulnerable to having the plaintext modified (rather than just being scrambled) by modifying the ciphertext. With CBC, as in the example you linked to, modifying the IV let's you change a portion of the first block if you know which bytes are which and have some idea of what they contain, and message bytes in other blocks can also be changed.

In several chained block cipher modes, changing the ciphertext will also scramble one or more blocks of the message. With CBC mode, the block preceding the plaintext you're modifying will be completely scrambled (though if you're modifying the first block by changing the IV, no other blocks are modified, since the IV doesn't correspond to any plaintext block). In a stream cipher (and a OTP is just an ideal stream cipher), changing a byte of the ciphertext only affects the one byte of plaintext, making such an attack even easier.

The way to guard against such changes (in both streaming and block modes) is to use a Message Authentication Code. One such MAC, called CBC-MAC, uses the CBC mode of a block cipher (using an IV of zero and only using the final block), and there are other MACs available (e.g. HMAC).

There are a few ways you could use a MAC with a OTP. A MAC needs a key, so you could encrypt the key as part of the message (using the OTP). You would then put the MAC output into the message stream without any additional encryption (no need to waste your precious OTP bits). In that mode you would need to use what's called Encrypt-then-MAC, i.e. do the MAC over the ciphertext, not the plaintext.

A OTP is 100% secure against revealing the plaintext by looking at the ciphertext, but is very vulnerable to attacks that can change the ciphertext. Depending on how the decrypted message is handled, such attacks can even end up revealing plaintext. It's critical that some form of message integrity be used with a OTP or stream cipher, as is the case with any cipher mode that doesn't already have it built-in (e.g. Authenticated Encryption).

Another way of using a block cipher with a OTP would be to encrypt blocks with the block cipher either before or after using the OTP. While that wouldn't add any secrecy (since the OTP already guarantees that), you might think that using it would prevent the type of changes discussed (changing \$100 to \$900, etc). Unfortunately, you'd still want to have some sort of integrity check anyway, so it doesn't gain you anything. In addition, using a mode like CBC doesn't protect against such modifications, using it with a OTP is no better than using it without the OTP.

Perfect secrecy is a security concept mathematically proved to be true for the one-time pad by Shannon in 1949.

One-time pad is offering perfect secrecy if used with these three properties :

• The key space (number of possible keys) is greater than the number of possible plaintexts
• The key is truly random : each key of the key space has the same probability to be chose
• The key has to be used only once (this is not two-time pad ;) )

Respecting these properties, you don't need to add any cryptographic mechanism (like CBC) to one-time pad.