# Weakness in a CBC-like XOR cipher

A simple symmetric encryption algorithm can be written as follows:

1. Input message M and 64 bit key $$K$$
2. Divide M into 64 bit size blocks $$B_1...B_n$$
3. Get first block $$B_1$$ and perform bit-wise $$\oplus$$ with K to produce encrypted block $$E_1$$
4. Repeat
Get next block $$B_i$$ and perform bit-wise $$\oplus$$ with $$E_{i-1}$$ to produce encrypted block $$E_i$$
5. Until End of message

Q) What is the weakness in the above Algorithm if $$K = B_1$$(first 64 bits in message)

This may seem like an assignment question because it is. I think I know what is happening here. From the algorithm,

$$E_1= Key \oplus B_1$$ and $$E_i=E_{i-1} \oplus B_i$$ for all $$i>1$$

If encrypted text is known, it is possible to get plaintext using $$B_i = E_{i-1} \oplus E_i$$. With the help of this formula, we can derive the entire plain text without having any knowledge of the key.

The algorithm is weak even if $$K \neq B_1$$ because even then we are able to get the plaintext from ciphertext without any knowledge of the key. However, can we use the fact that Key is equal B1 in this scenario and get any meaningful outcome?

I know that if $$K = B_1$$, $$E_1$$ will become 0, then $$E_2=B_2$$. I am stuck here. So can I draw any other conclusion from it?or is my approach completely wrong?

## 2 Answers

Fundamental ideas:

$$a \oplus a = 0$$

$$a\oplus 0 = a$$

also if $$K = B_{1}$$ , $$E_{1} = 0$$ and as per your scheme $$B_{2} \oplus E_{1} = E_{2} = B_{2}$$

As a result of you setting $$K = B_{1}$$ you cannot decrypt the first block if you do not know $$B_{1}$$. This system is fundamentally broken, it can never be used in practice. This assignment question sadly does not give the correct idea of CBC . Practical CBC mode of Block Ciphers like AES work in a very different way. For example if we have an Encryption function $$E_{k}$$ then this is how CBC encryption works.

$$C_{0} =E_{k}(IV\oplus M_{0})$$

$$C_{1} =E_{k}(C_{0}\oplus M_{1})$$ and so on... As you can see there is an application of a very strong encryption function $$E_{k}$$ which could be something like AES. Here you are doing a simple XOR. Prima facie, your your scheme is subject to known - plaintext attacks and a 64 bit key is always brute force search able. I might have missed some crucial points but this is what I can think of now !!!

• E1 = E2 was a typo. I meant to write E2 = B2. I've edited it. You may remove the part about E1 = E2 in your responose. Thanks – Tom Riddle Apr 23 '20 at 5:41
• @TomRiddle Please see my edits! – Vivekanand V Apr 23 '20 at 5:43
• The sort comings for practical CBC mode are 1.) Incompitable for parallel implementation 2.) The cipher block size is increased by one block, the IV needs to be secret. – Radium Apr 23 '20 at 7:14
• @MdRasidAli In practice I would never advice anybody to use CBC , because of Padding Oracle attacks and such, but I said so because OP wants to know about CBC scenario. Also, IV is not secret in CBC. – Vivekanand V Apr 23 '20 at 7:18
• @VivekanandV Yeah, you are right; the IV need not be secret in CBC. I messed that with counter mode. – Radium Apr 23 '20 at 8:22

What you are thinking is absolutely right.

Let we have $$B=(B_1,B_2,B_3,B_4)$$ then the generalized structure of the scheme is,

$$E_1=(B_1\oplus K)$$

$$E_2=(B_2 \oplus B_1\oplus K)$$

$$E_2=(B_3 \oplus B_2 \oplus B_1\oplus K)$$

$$E_2=(B_4 \oplus B_3 \oplus B_2 \oplus B_1\oplus K)$$

As you have correctly told, you always get the message block without even knowing the key.

$$B_i=(E_i \oplus E_{i-1})$$

One thing you can see is that using this approach you can recover till $$E_2$$, and when you have $$E_1$$ in hand and the message is public you can always recover the key by $$K=(B_1 \oplus E_1)$$. So, your special case $$(K=B_1)$$ does bother/ help you in any significant margin.