-1
$\begingroup$

I have a doubt about parallelizability and preprocessing in modes of operation.

I understand that these two technologies are able just when the "block" is independent. In another way, ad example in CBC, since the second(and so on) block depend on the previous one, we can't apply this two property.

I saw this question for understand this.

I tried to invent a mode like this

I hope that I don't wrong anything.. but in this case, I can apply nobody's property (in encryption and decryption). I Invent this mode inspiring by CBC. In fact, I can't parallelize the encrypt and decryption too (because for the second block I need the first one to compute the XOR (the same for the decryption).

The preprocessing is pretty the same because the block depends on each other, so without XOR, I can't do more.

Does anyone agree with me? Or I m wronging?

$\endgroup$
5
  • $\begingroup$ You should definitely look at XEX mode. $\endgroup$ – kelalaka Jan 20 '20 at 11:10
  • 1
    $\begingroup$ Hint: in your mode, can you recognize from the ciphertext that the second block of plaintext is all-zero? What would that mean to CPA-security? $\endgroup$ – fgrieu Jan 20 '20 at 11:21
  • $\begingroup$ @kelalaka i think my set is more secure because I take the output of the first XOR for computer the second XOR. In XEX Use often the same key, so I think that mode can be parallelized and preprocessing in an easy way.. If I m not wronging. $\endgroup$ – theantomc Jan 20 '20 at 11:26
  • $\begingroup$ @fgrieu If I' m not wronging but my modes don't be affected from CPA $\endgroup$ – theantomc Jan 20 '20 at 11:28
  • $\begingroup$ if I swap the first block with the third, all the XOR will be wrong. Because the errors will be propagate @fgrieu $\endgroup$ – theantomc Jan 20 '20 at 11:34
2
$\begingroup$

If the second plaintext block is all-zero, then the second ciphertext block is IV2, which is testable. This blows CPA security, which is a fatal flaw.

$\endgroup$
3
  • $\begingroup$ This affects on the parallelization and preprocessing too? Because just if it won't have a CPA is parallelizable/pre-processable ? $\endgroup$ – theantomc Jan 20 '20 at 11:55
  • $\begingroup$ @theantomc: I do not understand your comment. The attack is against security, bringing it at (or even below) the security of ECB mode. That's irrespective of if the implementation is parallel or not. If we don't need CPA security (which is rare), why not use ECB, which parallelize fully? The simplest CPA-secure mode of operation that parallelize fully is CTR mode, and it's single serious drawback is vulnerability to poor choice of IV. It's malleable, but integrity is explicitly not one of its goal, which must be obtained otherwise. $\endgroup$ – fgrieu Jan 20 '20 at 12:15
  • $\begingroup$ Sorry, i Just mean if this 2 feature is connect with CPA but you answer me (that isnt). By the way in my mode i cant do parallel and preprocessing? I m right? $\endgroup$ – theantomc Jan 20 '20 at 13:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.