Suppose the decryption program is already built. Now I want to encrypt an arbitrary plain text given the IV and the decryption program (no key). From the formulas, we have $$Dec(C_i)\oplus C_{i-1}=P_i$$ $$Dec(C_1)\oplus IV=P_1$$. However, given these information, I can only figure out $Dec(C_1)$. I have read this question, but it assumes all $Dec(C_i)$ are known, which is not correct for my case. My question is how can I find out all $C_i$? (Please note there isn't a database of $P_i$, $Dec(C_i)$ pairs to look up collisions).

I thought about using the decryption program to brute force each possibility, but it will take too long time. I also tried applying similar technique for decryption algorithm(tried to reverse the process), but still can't get a result. Any hints would be appreciated.


CBC encryption requires the encryption operation of the cipher, which cannot be build from just the decryption operation of the cipher. Your solution space is empty.

Padding oracle attacks let you find the plaintext without attacking the cipher itself. That's not the same as creating an encryption oracle.

| improve this answer | |
  • $\begingroup$ I found this method, but it does not have a control of IV, which is not what I need. $\endgroup$ – Simple Mistake Apr 9 '17 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.