Cipher Block Chaining

Question

I don't want the answer to this problem, I just want to understand the steps that need to be followed to solve it. Maybe an example could help.

Problem

We use $\mathbin\Vert$ for concatenation.

Let $P_1 \mathbin\Vert P_2$ be a message that is two blocks long, and let $P'_1$ be a message that is one block long.

Let $C_0 \mathbin\Vert C_1 \mathbin\Vert C_2$ be the encryption of $P_1 \mathbin\Vert P_2$ using CBC mode with a random IV and a random key, and let $C'_0 \mathbin\Vert C'_1$ be the encryption of $P'_1$ using CBC mode with a random IV and the same key.

Suppose an attacker knows $P_1 \mathbin\Vert P_2$ and suppose the attacker intercepted and thus know $C_0 \mathbin\Vert C_1 \mathbin\Vert C_2$ and $C'_0 \mathbin\Vert C'_1$.
Further suppose that, by random chance, $C'_1=C_2$.

Show that the attacker can compute $P'_1$.

Answer 1

The problem suggests that the encryption does not use padding, and $C_0=\mathit{IV}$, $C_0'=\mathit{IV}'$. Then $$E_k(C_0\oplus P_1) = C_1$$ $$E_k(C_1\oplus P_2) = C_2$$ $$E_k(C_0'\oplus P_1') = C_1'$$ You also have $$C_1'=C_2$$ That is enough to find $P_1'$.

Answer 2

\begin{eqnarray} E_k(P_1'\oplus C_0')&=&C_1'\\ P_1'\oplus C_0'&=& E_k^{-1}(C_1')\\ P_1'&=&E_k^{-1}(C_1')\oplus C_0'\\ P_1'&=& E_k^{-1}(E_k(C_1\oplus P_2))\oplus C_0' \because C_1'=C_2=E_k(C_1\oplus P_2)\\ P_1'&=&C_1\oplus P_2 \oplus C_0' \end{eqnarray}