Indistinguishability attack example

Question

I want solve the next exercise. The author defined the experiment for the cryptosystem $\Pi$, the adversary $A$ and the security parameter $n$ as follows

$\mathsf{PRIV_{EAV}}(\Pi,A,n)$

1. The adversary $A$ get the input $1^n$ and choose two messages $m^{(0)}$, $m^{(1)} \in M$ with same length;
2. One key $k \in K$ is generated using $\mathsf{Gen}(1^n)$, and one bit is chosen uniformly at random. Then the message $m^{(b)}$ is encrypted and sent to $A$;
3. Eventually $A$ outputs b';
4. If $b=b'$, the experiment result is 1. Otherwise 0.

Definition A cryptosystem $\Pi$ has indistiguishable ciphertexts in the presence of an eavesdropper if for all adversaries $A$ there exist a negligible function $\mathsf{negl}$ such that

$$\Pr[\mathsf{PRIV_{EAV}}(\Pi,A,n)=1]\leq 1/2 + \mathsf{negl}(n).$$

My question: How will I be able to prove that the cryptosystem described below is not secure under the definition above.

Cryptosystem $\Pi$:

• $\mathsf{Gen}(1^n)$ chooses a bitstring $k \in \{0,1\}^n$ uniformly at random,
• $\mathsf{Enc}(m,k)$ works as follows: The message $m$ is split into blocks $m_0, m_1, \dots ,m_l$ of $n$ bits. Each block is encrypted separately, as $c_i = m_i \oplus k$. The ciphertext is then the concatenation of the encrypted blocks $c_0, c_1, \dots ,c_l$;
• $\mathsf{Dec}(c,k)$ is analogous to Enc, but permuting $c$ and $m$.

Notation

$K$ is the key space, $M$ the message space and $C$ the ciphertex space

Answer 1

To prove that a scheme is not secure under such a definition you usually would propose an algorithm such that the experiment described in your question outputs $1$ with probability non-negligibly larger than $1/2$.

As this looks very much like a homework problem I will not give you a solution. However constructing the algorithm is actually very simple in this case. You only need to think about how you would choose the messages $m^{(0)},m^{(1)}$ in such a way that you would be able to distinguish their ciphertexts.

As a hint: The deterministic nature of the encryption-process could be a problem here, and you can actually distinguish with probability $1$.