Weakness in a CBC-like XOR cipher

Question

A simple symmetric encryption algorithm can be written as follows:

1. Input message M and 64 bit key $K$
2. Divide M into 64 bit size blocks $B_1...B_n$
3. Get first block $B_1$ and perform bit-wise $\oplus$ with K to produce encrypted block $E_1$
4. Repeat
   Get next block $B_i$ and perform bit-wise $\oplus$ with $E_{i-1}$ to produce encrypted block $E_i$
5. Until End of message

Q) What is the weakness in the above Algorithm if $K = B_1$(first 64 bits in message)

This may seem like an assignment question because it is. I think I know what is happening here. From the algorithm,

$E_1= Key \oplus B_1$ and $E_i=E_{i-1} \oplus B_i$ for all $i>1$

If encrypted text is known, it is possible to get plaintext using $B_i = E_{i-1} \oplus E_i$. With the help of this formula, we can derive the entire plain text without having any knowledge of the key.

The algorithm is weak even if $K \neq B_1$ because even then we are able to get the plaintext from ciphertext without any knowledge of the key. However, can we use the fact that Key is equal B1 in this scenario and get any meaningful outcome?

I know that if $K = B_1$, $E_1$ will become 0, then $E_2=B_2$. I am stuck here. So can I draw any other conclusion from it?or is my approach completely wrong?

Answer 1

Fundamental ideas:

$ a \oplus a = 0$

$ a\oplus 0 = a$

also if $K = B_{1}$ , $E_{1} = 0$ and as per your scheme $ B_{2} \oplus E_{1} = E_{2} = B_{2} $

As a result of you setting $K = B_{1}$ you cannot decrypt the first block if you do not know $B_{1}$. This system is fundamentally broken, it can never be used in practice. This assignment question sadly does not give the correct idea of CBC . Practical CBC mode of Block Ciphers like AES work in a very different way. For example if we have an Encryption function $E_{k}$ then this is how CBC encryption works.

$C_{0} =E_{k}(IV\oplus M_{0})$

$C_{1} =E_{k}(C_{0}\oplus M_{1})$ and so on... As you can see there is an application of a very strong encryption function $E_{k}$ which could be something like AES. Here you are doing a simple XOR. Prima facie, your your scheme is subject to known - plaintext attacks and a 64 bit key is always brute force search able. I might have missed some crucial points but this is what I can think of now !!!

Answer 2

What you are thinking is absolutely right.

Let we have $B=(B_1,B_2,B_3,B_4)$ then the generalized structure of the scheme is,

$E_1=(B_1\oplus K)$

$E_2=(B_2 \oplus B_1\oplus K)$

$E_2=(B_3 \oplus B_2 \oplus B_1\oplus K)$

$E_2=(B_4 \oplus B_3 \oplus B_2 \oplus B_1\oplus K)$

As you have correctly told, you always get the message block without even knowing the key.

$B_i=(E_i \oplus E_{i-1})$

One thing you can see is that using this approach you can recover till $E_2$, and when you have $E_1$ in hand and the message is public you can always recover the key by $K=(B_1 \oplus E_1)$. So, your special case $(K=B_1)$ does bother/ help you in any significant margin.