I've seen questions where people have asked if AES-CBC mode is vulnerable to chosen cipher-text attacks if the IV is predictable.

But is it guaranteed to be secure against chosen cipher text attacks if the IV is not predictable?


No, unpredictable IV won't solve the problem (cihpertext is malleable).

One example to demonstrate the insecurity:

in the CCA game, the adversary sends $m_0,m_1$ to the challenger, and receive back the ciphertext $c=(r,s)=(r, E_k(r\oplus m_b)$), where $r$ is the random IV.

Then the adversary sends $c'=(r\oplus t,s)$ where $t$ is a random string.

The oracle will decrypts becausee $c'\ne c$, and the adversary now gets $$ D_k(s)\oplus r\oplus t = D_{k}(E_k(r\oplus m_b))\oplus r\oplus t=m_b\oplus t $$

The adversary then compute $m_b\oplus t \oplus t =m_b$ and can decide $b$ by comparing the result with the messages it sent.

One way to obtain CCA security is to use a message authentication code and the encrypt-then-mac procedure (authenticated encryption).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.