-1
$\begingroup$

I have a doubt about parallelizability and preprocessing in modes of operation.

I understand that these two technologies are able just when the "block" is independent. In another way, ad example in CBC, since the second(and so on) block depend on the previous one, we can't apply this two property.

I saw this question for understand this.

I tried to invent a mode like this

I hope that I don't wrong anything.. but in this case, I can apply nobody's property (in encryption and decryption). I Invent this mode inspiring by CBC. In fact, I can't parallelize the encrypt and decryption too (because for the second block I need the first one to compute the XOR (the same for the decryption).

The preprocessing is pretty the same because the block depends on each other, so without XOR, I can't do more.

Does anyone agree with me? Or I m wronging?

Improve this question
$\endgroup$
5
  • $\begingroup$ You should definitely look at XEX mode. $\endgroup$
    – kelalaka
    Commented Jan 20, 2020 at 11:10
  • 1
    $\begingroup$ Hint: in your mode, can you recognize from the ciphertext that the second block of plaintext is all-zero? What would that mean to CPA-security? $\endgroup$
    – fgrieu ♦
    Commented Jan 20, 2020 at 11:21
  • $\begingroup$ @kelalaka i think my set is more secure because I take the output of the first XOR for computer the second XOR. In XEX Use often the same key, so I think that mode can be parallelized and preprocessing in an easy way.. If I m not wronging. $\endgroup$
    – theantomc
    Commented Jan 20, 2020 at 11:26
  • $\begingroup$ @fgrieu If I' m not wronging but my modes don't be affected from CPA $\endgroup$
    – theantomc
    Commented Jan 20, 2020 at 11:28
  • $\begingroup$ if I swap the first block with the third, all the XOR will be wrong. Because the errors will be propagate @fgrieu $\endgroup$
    – theantomc
    Commented Jan 20, 2020 at 11:34

1 Answer 1

Reset to default
2
$\begingroup$

If the second plaintext block is all-zero, then the second ciphertext block is IV2, which is testable. This blows CPA security, which is a fatal flaw.

Improve this answer
$\endgroup$
3
  • $\begingroup$ This affects on the parallelization and preprocessing too? Because just if it won't have a CPA is parallelizable/pre-processable ? $\endgroup$
    – theantomc
    Commented Jan 20, 2020 at 11:55
  • $\begingroup$ @theantomc: I do not understand your comment. The attack is against security, bringing it at (or even below) the security of ECB mode. That's irrespective of if the implementation is parallel or not. If we don't need CPA security (which is rare), why not use ECB, which parallelize fully? The simplest CPA-secure mode of operation that parallelize fully is CTR mode, and it's single serious drawback is vulnerability to poor choice of IV. It's malleable, but integrity is explicitly not one of its goal, which must be obtained otherwise. $\endgroup$
    – fgrieu ♦
    Commented Jan 20, 2020 at 12:15
  • $\begingroup$ Sorry, i Just mean if this 2 feature is connect with CPA but you answer me (that isnt). By the way in my mode i cant do parallel and preprocessing? I m right? $\endgroup$
    – theantomc
    Commented Jan 20, 2020 at 13:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.