1
$\begingroup$

I have just learned about the CBC mode of operation and that it gives the cipher by xoring the plaintext m0 with random IV and then encrypt it with random key and I found out that the CBC is not CPA-secure if the IV can be predictable.

I'm considering a new mode like what if CBC work by encrypting the plain text and then xored with the IV is it still CPA secure? and is still the IV can be predictable over CPA attack?

$C_0 = IV \oplus E(P_0)$ and $C_i = C_{i-1} \oplus E(P_i)$ for $i>0$

My guessing is that it is not secure because im not encrypting the IV im only xoring it with the E(m), an attacker can do a CPA attack on the E(m) and then xor it with the IV that he has guessed it and then can compare it with the Cipher and guessed the key.

$\endgroup$
2
$\begingroup$

It is a really bad idea to have $$C_i = C_{i-1} \oplus E(P_i).$$ The ciphertext leaks a deterministic function of each plaintext block, as $$C_i \oplus C_{i-1} =E(P_i).$$ Now an eavesdropper can easily tell whether $P_i = P_j$ by checking whether $$C_{i-1} \oplus C_i = C_{j-1} \oplus C_j.$$

| improve this answer | |
$\endgroup$
1
$\begingroup$

Well, you're guessing correctly of course. It would be very easy to distinguish any initial blocks if you know or guess a significant part of the IV.

This is very easy to see even if you just look at the first block:

$$C_0 = IV \oplus E(P_0)$$

Say that $IV$ is (partially) known; in that case $E(P_0)$ is known for a specific $E(P_0)$. Now obviously if we have a message $P'$ where $P'_0 = P_0$ then you can compare $C'_0 = C'_1$ if the IV is fully known.

If information about the IV is not complete then you could use any function to compare the two ciphertexts that can predict with a probability higher than $1 / 2^{128}$ that the two ciphertexts are identical.


If you want to look for a better CBC then you can just use:

$$IV = E(IV')$$

That way the IV is a keyed random permutation over some predictable but unique data $IV'$ (i.e. a non-random nonce). The result of that should still be unpredictable. This should have minimal impact on the security of the cipher (assuming it is just used for CBC otherwise).

| improve this answer | |
$\endgroup$
  • $\begingroup$ Never see the last part before, any paper or link about that? $\endgroup$ – kelalaka Feb 22 at 20:04
  • 1
    $\begingroup$ Uh, it's in the password standards - I don't have a paper that describes the trick. It is just randomization of the IV. It's fine as long as you don't use IV' instead as IV (i.e. try and make it a secret IV). Then the scheme is terribly broken. Here is another description of the same scheme by CodesInChaos. Note the date. And it points to a proof of the scheme here by Squeamish. Vote them up when you agree with them! $\endgroup$ – Maarten Bodewes Feb 22 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.