In CBC mode I know that if i get a corrupted Ci* block than Pi and Pi+1 will be wrong during the decryption, but i believe that this happens only when Ci* is not envolved during the feedback stage at the encryption, my question is what happens if the corrupted block is a feedback at the encryption stage, will it have the same impact as before?
6
-
$\begingroup$ What exactly do you mean by "the feedback stage"? AFAIK, there is no "feedback stage" in CBC mode that some blocks would not be involved in. Well, except for the trivial fact that the last block obviously has no following block to chain it with. $\endgroup$– Ilmari KaronenCommented Dec 1, 2017 at 9:30
-
$\begingroup$ By feedback i mean that in order to encrypt Pi i have to use Ci-1. $\endgroup$– AlonsoCommented Dec 1, 2017 at 9:53
-
$\begingroup$ OK, so which blocks do you think that's not the case for? $\endgroup$– Ilmari KaronenCommented Dec 1, 2017 at 10:24
-
$\begingroup$ In my opinion only C3 will decrypt uncorrectly because during the encryption all the later to C3 blocks will be encrypted using C3 so it dosent really matter if something happend to C3. During the decryption all the other blocks will give me the correct plain text $\endgroup$– AlonsoCommented Dec 1, 2017 at 11:21
-
1$\begingroup$ i have read the wiki description, but i still don't understand, if i use a corrupted Ci* during the encryption i will get a Ci+1 instead of a Ci+1, but when i decrypt them shouldnt i get the same Pi+1? Or perhaps because of the miss calculation of Ci all the later blocks will be garbled during the decryption, because the IV lost it's meaning in the process? F.Y.I i appreciate the patience $\endgroup$– AlonsoCommented Dec 1, 2017 at 13:53
|
Show 1 more comment
2 Answers
$\begingroup$
$\endgroup$
As you can see in the Wikipedia article a ciphertext block is used for two different things during decryption:
- as input to the block cipher to calculate the output, which is then XOR'ed with the previous ciphertext block to create the corresponding plaintext block at the same position;
- as input to the XOR to calculate the next plaintext block, together with the next decrypted block.
You can see it clearly in the picture, by following the arrows of one of the ciphertext blocks:
(XOR is denoted by $\oplus$ )
As the block cipher is a pseudo random permutation the plaintext block at the same position is indistinguishable from random even if only one bit is changed. The fact that it is XOR'ed with the value of the previous ciphertext block does not change this fact. There is only one restriction: the result is not identical to the plaintext block that would be calculated without the change.
Things are different with the next plaintext block. Only those bits that have flipped in the ciphertext block will be flipped in the next plaintext block. So the change is localized and not random.
Next or previous blocks are not affected as the affected ciphertext block, intermediate values or plaintext blocks are not used as input anywhere else.
answered Dec 2, 2017 at 0:03
$\begingroup$
$\endgroup$
When one ciphertext block is altered at encryption and enters the feedback stage, this also changes all later ciphertext blocks. However it affects only a single block of the deciphered plaintext, rather than two for the corruption of a ciphertext block after encryption.
The question considers the case of a ciphertext block that gets corrupted at encryption (say, because a cosmic ray hits the block cipher engine and corrupts something in one round). This is indeed different from the textbook case of a ciphertext block that getting corrupted between encryption and decryption (say during transmission).
CBC encryption goes $C_{i+1}=E_K(P_i\oplus C_i)$ with $C_0$ the random IV. If an error occurs there and the resulting modified $C_{i+1}$ gets in the feedback, that alters $P_{i+1}\oplus C_{i+1}$, thus (since $E_K$ is a bijection) $C_{i+2}$ . By induction, all later ciphertext blocks are altered.
CBC decryption goes $P_i=D_K(C_{i+1})\oplus C_i$. By a reasoning as above, the modified $C_{i+1}$ turns into a modified $P_i$. But no other decryption error follows; in particular, for the next block $P_{i+1}=D_K(C_{i+2})\oplus C_{i+1}$, both $C_{i+1}$ and $C_{i+2}$ used by the decryption side match the ones used on the encryption side, and $P_{i+1}$ is correctly deciphered.
