# Block cipher information leakage using same key

This is from a previous exam question and I'm not really sure how to approach this properly

We're using a block-cipher mode that encrypts

$$C_i$$ = $$E_k$$ ($$P_i$$ $$\oplus$$ $$C_{i-1}$$ $$\oplus$$ $$P_{i-1}$$) with $$C_0$$ = IV and $$P_0$$ = 0.

Indicate whether information leaks on the plaintext if too many plaintext blocks are encrypted under the same key (use as example DES).

Now I'm not really sure how to indicate this. But I assumed that if the IV is truly random that no leakage should happen.

My opinion even if you do a chosen-plaintext attack where $$P_1$$ = 0

$$C_1$$ = $$E_k$$ ($$P_1$$ $$\oplus$$ $$IV$$ $$\oplus$$ $$P_0$$) = $$E_k$$ ($$0$$ $$\oplus$$ $$IV$$ $$\oplus$$ $$0$$) which would give $$C_1$$ = $$E_k$$ ($$IV$$)

$$C_2$$ = $$E_k$$ ($$P_2$$ $$\oplus$$ $$C_1$$ $$\oplus$$ $$P_1$$) = $$E_k$$ ($$P_2$$ $$\oplus$$ $$E_k$$ ($$IV$$) $$\oplus$$ $$0$$)

$$...$$

I don't see how it would leak any information on the plaintext. I might be assessing the question wrong though.

• Maybe this is going for a collision attack like Sweet32? Jun 9, 2019 at 18:58

The reason for the 'birthday bound' in block ciphers are collisions that may occur after an expected $$2^{n/2}$$ blocks (or lack there-of); cases where the inputs to the block cipher is exactly the same (and hence the output is as well).
• I always find the combination of "expected collisions" and $2^{n/2}$ rather wanting. It sounds all or nothing. A 50% probability of collision is in security terms virtually 100%. NIST recognises this asymptotic distribution with their block/byte count recommendations, and true expected collision probabilities in terms of security levels. I can't find (on this forum) where this has been rigorously dealt with. Just a €'s worth... Jul 10, 2019 at 0:35