1
$\begingroup$

I don't want the answer to this problem, I just want to understand the steps that need to be followed to solve it. Maybe an example could help.

Problem

We use $\mathbin\Vert$ for concatenation.

Let $P_1 \mathbin\Vert P_2$ be a message that is two blocks long, and let $P'_1$ be a message that is one block long.

Let $C_0 \mathbin\Vert C_1 \mathbin\Vert C_2$ be the encryption of $P_1 \mathbin\Vert P_2$ using CBC mode with a random IV and a random key, and let $C'_0 \mathbin\Vert C'_1$ be the encryption of $P'_1$ using CBC mode with a random IV and the same key.

Suppose an attacker knows $P_1 \mathbin\Vert P_2$ and suppose the attacker intercepted and thus know $C_0 \mathbin\Vert C_1 \mathbin\Vert C_2$ and $C'_0 \mathbin\Vert C'_1$.
Further suppose that, by random chance, $C'_1=C_2$.

Show that the attacker can compute $P'_1$.

$\endgroup$
1
$\begingroup$

The problem suggests that the encryption does not use padding, and $C_0=\mathit{IV}$, $C_0'=\mathit{IV}'$. Then $$E_k(C_0\oplus P_1) = C_1$$ $$E_k(C_1\oplus P_2) = C_2$$ $$E_k(C_0'\oplus P_1') = C_1'$$ You also have $$C_1'=C_2$$ That is enough to find $P_1'$.

$\endgroup$
0
$\begingroup$

\begin{eqnarray} E_k(P_1'\oplus C_0')&=&C_1'\\ P_1'\oplus C_0'&=& E_k^{-1}(C_1')\\ P_1'&=&E_k^{-1}(C_1')\oplus C_0'\\ P_1'&=& E_k^{-1}(E_k(C_1\oplus P_2))\oplus C_0' \because C_1'=C_2=E_k(C_1\oplus P_2)\\ P_1'&=&C_1\oplus P_2 \oplus C_0' \end{eqnarray}

$\endgroup$
  • 2
    $\begingroup$ I guess you missed "I don't want the answer to this problem, I just want to understand the steps that need to be followed to solve it." $\endgroup$ – tylo Nov 3 '16 at 15:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.