Cipher Block chaining but with encrypting the plain text first then xor with IV

Question

I have just learned about the CBC mode of operation and that it gives the cipher by xoring the plaintext m0 with random IV and then encrypt it with random key and I found out that the CBC is not CPA-secure if the IV can be predictable.

I'm considering a new mode like what if CBC work by encrypting the plain text and then xored with the IV is it still CPA secure? and is still the IV can be predictable over CPA attack?

$C_0 = IV \oplus E(P_0)$ and $C_i = C_{i-1} \oplus E(P_i)$ for $i>0$

My guessing is that it is not secure because im not encrypting the IV im only xoring it with the E(m), an attacker can do a CPA attack on the E(m) and then xor it with the IV that he has guessed it and then can compare it with the Cipher and guessed the key.

Answer 1

It is a really bad idea to have $$C_i = C_{i-1} \oplus E(P_i).$$ The ciphertext leaks a deterministic function of each plaintext block, as $$C_i \oplus C_{i-1} =E(P_i).$$ Now an eavesdropper can easily tell whether $P_i = P_j$ by checking whether $$C_{i-1} \oplus C_i = C_{j-1} \oplus C_j.$$

Answer 2

Well, you're guessing correctly of course. It would be very easy to distinguish any initial blocks if you know or guess a significant part of the IV.

This is very easy to see even if you just look at the first block:

$$C_0 = IV \oplus E(P_0)$$

Say that $IV$ is (partially) known; in that case $E(P_0)$ is known for a specific $E(P_0)$. Now obviously if we have a message $P'$ where $P'_0 = P_0$ then you can compare $C'_0 = C'_1$ if the IV is fully known.

If information about the IV is not complete then you could use any function to compare the two ciphertexts that can predict with a probability higher than $1 / 2^{128}$ that the two ciphertexts are identical.

---

If you want to look for a better CBC then you can just use:

$$IV = E(IV')$$

That way the IV is a keyed random permutation over some predictable but unique data $IV'$ (i.e. a non-random nonce). The result of that should still be unpredictable. This should have minimal impact on the security of the cipher (assuming it is just used for CBC otherwise).