Let P1P2...Pn be n blocks plaintext, and M0 be a random IV. Then a n+1 blocks message M0M1...Mn can be constructed by setting Mi+1 = Mi xor Pi+1. Finally, we use AES-ECB to encrypt this message. Is it as secure as using AES-CBC?
No, this is not a secure way of encrypting. Specifically, it does not meet the requirements for indistinguishability under chosen plaintext attack (IND-CPA), a basic security definition for encryption.
According to IND-CPA, no attacker should be able to win the following game:
- The attacker selects two equal-length plaintext messages.
- The defender picks one of those plaintexts at random
- The defender encrypts that plaintext and provides the ciphertext to the attacker
- The attacker wins if it can determine which of the plaintexts was used
Here's a winning strategy for an attacker facing your scheme:
- Let plaintext message 1 consist of a single block containing only zero bits.
- Let plaintext message 2 be any other single-block message.
- If the defender returns a ciphertext where the two ciphertext blocks are equal, then the attacker knows that plaintext message 1 was selected; else, the attacker knows that plaintext message 2 was selected.
Here's why this works:
In plaintext message 1, $P_1 = 0^n$ (i.e. $n$ zero bits), where $n$ is the number of bits in a block. This means that $M_1 = M_0 \oplus P_1 = M_0 \oplus 0^n = M_0$, so $M_1 = M_0$. ECB mode produces ciphertext blocks $C_i = E_k(M_i)$, and $E_k$ is deterministic, so the ciphertext blocks will also match ($C_1 = C_0$).
In plaintext message 2, this equality will not hold: $P_1$ has at least one non-zero bit, so $M_1$ and $M_0$ will differ in at least one bit, resulting in different ciphertext blocks ($C_1 \neq C_0$).