I know that the security from CBC stems from the fact that since each message block is randomized by xoring it with a block cipher output, each new call to $E_{K}$ is independent from the previous ones and no attacker can succeed unless a random collision occurs. However, assume that $C[i − 1]$ is known when choosing $M[i]$. The independence is clearly lost. But how could one efficiently attack that system compromising real-or-Random (ROR) security?

  • $\begingroup$ What happens if you pick $M[i] = C[i - 1]$? $\endgroup$ – Squeamish Ossifrage Oct 27 '19 at 15:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.