# Cipher Block Chaining

I don't want the answer to this problem, I just want to understand the steps that need to be followed to solve it. Maybe an example could help.

## Problem

We use $\mathbin\Vert$ for concatenation.

Let $P_1 \mathbin\Vert P_2$ be a message that is two blocks long, and let $P'_1$ be a message that is one block long.

Let $C_0 \mathbin\Vert C_1 \mathbin\Vert C_2$ be the encryption of $P_1 \mathbin\Vert P_2$ using CBC mode with a random IV and a random key, and let $C'_0 \mathbin\Vert C'_1$ be the encryption of $P'_1$ using CBC mode with a random IV and the same key.

Suppose an attacker knows $P_1 \mathbin\Vert P_2$ and suppose the attacker intercepted and thus know $C_0 \mathbin\Vert C_1 \mathbin\Vert C_2$ and $C'_0 \mathbin\Vert C'_1$.
Further suppose that, by random chance, $C'_1=C_2$.

Show that the attacker can compute $P'_1$.

The problem suggests that the encryption does not use padding, and $C_0=\mathit{IV}$, $C_0'=\mathit{IV}'$. Then $$E_k(C_0\oplus P_1) = C_1$$ $$E_k(C_1\oplus P_2) = C_2$$ $$E_k(C_0'\oplus P_1') = C_1'$$ You also have $$C_1'=C_2$$ That is enough to find $P_1'$.