This is from a previous exam question and I'm not really sure how to approach this properly

We're using a block-cipher mode that encrypts

$C_i$ = $E_k$ ($P_i$ $\oplus$ $C_{i-1}$ $\oplus$ $P_{i-1}$) with $C_0$ = IV and $P_0$ = 0.

Indicate whether information leaks on the plaintext if too many plaintext blocks are encrypted under the same key (use as example DES).

Now I'm not really sure how to indicate this. But I assumed that if the IV is truly random that no leakage should happen.

My opinion even if you do a chosen-plaintext attack where $P_1$ = 0

$C_1$ = $E_k$ ($P_1$ $\oplus$ $IV$ $\oplus$ $P_0$) = $E_k$ ($0$ $\oplus$ $IV$ $\oplus$ $0$) which would give $C_1$ = $E_k$ ($IV$)

$C_2$ = $E_k$ ($P_2$ $\oplus$ $C_1$ $\oplus$ $P_1$) = $E_k$ ($P_2$ $\oplus$ $E_k$ ($IV$) $\oplus$ $0$)


I don't see how it would leak any information on the plaintext. I might be assessing the question wrong though.

  • $\begingroup$ Maybe this is going for a collision attack like Sweet32? $\endgroup$
    – SEJPM
    Commented Jun 9, 2019 at 18:58

1 Answer 1


The reason for the 'birthday bound' in block ciphers are collisions that may occur after an expected $2^{n/2}$ blocks (or lack there-of); cases where the inputs to the block cipher is exactly the same (and hence the output is as well).

How might someone, with a large amount of ciphertext, find such collisions in the mode in question? Having found such a collision, how might they use it to deduce information about the plaintext?

  • $\begingroup$ I always find the combination of "expected collisions" and $2^{n/2}$ rather wanting. It sounds all or nothing. A 50% probability of collision is in security terms virtually 100%. NIST recognises this asymptotic distribution with their block/byte count recommendations, and true expected collision probabilities in terms of security levels. I can't find (on this forum) where this has been rigorously dealt with. Just a €'s worth... $\endgroup$
    – Paul Uszak
    Commented Jul 10, 2019 at 0:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.