1
$\begingroup$

The adversary is has unlimited access to the encryption oracle. My thinking is that upon receiving the ciphertext C = $<c_0,c_1,c_2...,c_n>$ it will just use $c_0$ to XOR it with $F_k(m_1)$ to get the first ciphertext, which does nothing. The subsequent blocks remain undecrypted, right?

$\endgroup$
1
$\begingroup$

For any modern cipher (including a block in CBC mode) with proper implementation, nothing harmfull happens when any part of the plaintext gets known to the adversary. This adversary's knowledge does not extend to other bits of the plaintext.

Argument: any algorithm that could extract some additional knowledge could be turned into one breaking CPA security. For CBC, CPA security can be proven from security of the block cipher, under the assumptions that the IV is random, the number of blocks enciphered remains low enough (like, less than $2^{b/2-n}$ where $b$ is the block size in bits and $n$ is a security parameter), and the decryption side does not leak information about the deciphered plaintext (such as, incorrect padding).

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.