Let P1P2...Pn be n blocks plaintext, and M0 be a random IV. Then a n+1 blocks message M0M1...Mn can be constructed by setting Mi+1 = Mi xor Pi+1. Finally, we use AES-ECB to encrypt this message. Is it as secure as using AES-CBC?

  • $\begingroup$ Consider the effect of $P_i=0$. $\endgroup$ – CodesInChaos Mar 2 '16 at 9:52
  • $\begingroup$ @SEJPM That's a different mode. This mode uses the xor of all previous plaintext blocks and the IV. The other question only xors two adjacent blocks. $\endgroup$ – CodesInChaos Mar 2 '16 at 9:59

No, this is not a secure way of encrypting. Specifically, it does not meet the requirements for indistinguishability under chosen plaintext attack (IND-CPA), a basic security definition for encryption.

According to IND-CPA, no attacker should be able to win the following game:

  • The attacker selects two equal-length plaintext messages.
  • The defender picks one of those plaintexts at random
  • The defender encrypts that plaintext and provides the ciphertext to the attacker
  • The attacker wins if it can determine which of the plaintexts was used

Here's a winning strategy for an attacker facing your scheme:

  • Let plaintext message 1 consist of a single block containing only zero bits.
  • Let plaintext message 2 be any other single-block message.
  • If the defender returns a ciphertext where the two ciphertext blocks are equal, then the attacker knows that plaintext message 1 was selected; else, the attacker knows that plaintext message 2 was selected.

Here's why this works:

In plaintext message 1, $P_1 = 0^n$ (i.e. $n$ zero bits), where $n$ is the number of bits in a block. This means that $M_1 = M_0 \oplus P_1 = M_0 \oplus 0^n = M_0$, so $M_1 = M_0$. ECB mode produces ciphertext blocks $C_i = E_k(M_i)$, and $E_k$ is deterministic, so the ciphertext blocks will also match ($C_1 = C_0$).

In plaintext message 2, this equality will not hold: $P_1$ has at least one non-zero bit, so $M_1$ and $M_0$ will differ in at least one bit, resulting in different ciphertext blocks ($C_1 \neq C_0$).

  • $\begingroup$ I think it would be useful to note that the attack extends to later blocks even if the IV is not encrypted. $\endgroup$ – otus Mar 2 '16 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.