1
$\begingroup$

How can it be explained that CBC mode is not IND-CCA2 secure, in case that the IV can't be predicted by adversary.

Edit: In decryption of CBC, for each block it is XORed with previous block's cipher text. So there is no need to decrypt previous block before XORing it for the next block. Now if adversary change 1 bit in the received cipher text in IND-CCA2 and send it for decryption. As in IND-CCA2 only the challenge cipher text is not decrypted. Anything else will be decrypted. So as 1 of the bit in the challenge cipher text was changed so its plain text will be send back to adversary. For CBC modes decryption we know that plain text box corresponding to changed cipher will be corrupted and in following block of plain text corresponding bit to changed bit is inverted. Rest of the block remain same. So adversary will just compare these unchanged parts with the original messages it sent and with whichever message unchanged parts of cipher text messages matches it will pick that one and win the game. Is this approach to prove that CBC mode is not IND-CCA2 secure even if the adversary don`t know the IV?

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ Why do you suspect that this isn't a valid proof method? $\endgroup$
    – poncho
    Oct 3, 2016 at 17:16
  • $\begingroup$ A bit late for a party but your approach is perfectly valid $\endgroup$
    – ddnomad
    Jun 18, 2017 at 22:22

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.