3
$\begingroup$

why is Propagating CBC (PCBC) insecure for authenticated encryption? I received the hint that I should feed a message of length $n$ and a message of length $n-1$ to it, but I don't really get what the result gives me, as we still have this Xor with the previous message.

$\endgroup$
2
$\begingroup$

PCBC doesn't offer authentication at all; there is no cryptographic checksum calculated over the ciphertext, and there is no verification part within the algorithm.

The only thing that PCBC offers is error propagation over all subsequent blocks after a changed block in the ciphertext. However, as there is no verification at the end of the decryption, that will just mean that the (padded) plaintext will contain random data. This may result in a padding error, but it is also possible that it does not by pure chance.

Even if you would add a known plaintext at the end then PCBC will allow you to swap blocks of ciphertext in the middle. And if you add a cryptographic checksum before encryption (i.e. verified after decryption) then you may still be vulnerable against certain ECB-style plaintext attacks.

I'm not really sure what the differently sized messages are supposed to do, to be honest. Maybe somebody else knows the precise attack.


Just like any other secure mode of operation you can still use PCBC for authenticated encryption. For instance, you could use it for a PCBC-HMAC encrypt-then-MAC security scheme where the ciphertext is authenticated before decryption is performed.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.