The adversary is has unlimited access to the encryption oracle. My thinking is that upon receiving the ciphertext C = $<c_0,c_1,c_2...,c_n>$ it will just use $c_0$ to XOR it with $F_k(m_1)$ to get the first ciphertext, which does nothing. The subsequent blocks remain undecrypted, right?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
0
For any modern cipher (including a block in CBC mode) with proper implementation, nothing harmfull happens when any part of the plaintext gets known to the adversary. This adversary's knowledge does not extend to other bits of the plaintext.
Argument: any algorithm that could extract some additional knowledge could be turned into one breaking CPA security. For CBC, CPA security can be proven from security of the block cipher, under the assumptions that the IV is random, the number of blocks enciphered remains low enough (like, less than $2^{b/2-n}$ where $b$ is the block size in bits and $n$ is a security parameter), and the decryption side does not leak information about the deciphered plaintext (such as, incorrect padding).
