1
$\begingroup$

I am studying cryptography and various block cipher modes of operation.

Suppose I changed one bit in the last block of the message. Wouldn't that imply no change in all encrypted blocks except for the last one?

At least based on the description of how various modes work (CBC, OFB, etc), I don't see why that wouldn't be the case.

However, if that is true, then the encryption mode lacks the avalanche effect property, doesn't it? A single bit change in any place should completely change the encrypted text.

Could someone correct my observation, or explain why lack of avalanche effect is not dangerous?

$\endgroup$
  • $\begingroup$ there are modes that have the full avalanche effect (like EME) but they're generally not required as any tampering with the data will be detected by the message authentication code (MAC) which then produces an error upon decryption. $\endgroup$ – SEJPM Mar 23 '16 at 13:42
  • 2
    $\begingroup$ You cannot have an online (one-pass) mode with the avalanche property. $\endgroup$ – Artjom B. Mar 23 '16 at 13:45
2
$\begingroup$

We don't mind the lack of avalanche because of the IV.

The problem that not having full avalanche would have is that if we encrypt two related messages, for example, two messages that differ only in the last block, is that the ciphertexts would be related, for example, they differ only in the last block. Obviously, that'd not be good - at the very least, we'd be leaking that the plaintexts are related.

However, with the modes in question, this isn't a concern. If we do encrypt two related messages, we select a different IV for each message. It turns out that choosing a different IV makes the ciphertexts look completely different, even if the plaintexts are related (or even identical).

One cavaet to the above: with CBC mode, if the IV's were related (for example, had a small bit difference), and the first plaintext block happen to have the same bit difference, then this is leaked. That's why we specify that the CBC mode IV's are "random" (that is, unpredictable); other modes don't have this restriction.

|improve this answer|||||
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.