# Find first two blocks of plaintext given a final plaintext block, the IV and ciphertext for CBC?

I have the following:

• complete ciphertext;
• iv;
• last block of plaintext including the padding which is 04040404.

The encryption was made using AES-CBC-256. I can find the intermediate block by XOR-ing C2 with P3

I cannot use padding oracle because there is no server to validate padding. I didn't find any help about plaintext attack for 14 rounds, only for 4.

Is there any way to find the rest of plaintext (P1, P2) or the key for (C2 ⊕ P3, C3)?

• Welcome to Cryptography. What is the source of this question? – kelalaka Sep 3 '20 at 12:28

Let's consider what you know: you have the last block, the IV, and the entire ciphertext. What you don't know is the key or the plaintext. Since CBC-mode encryption uses the IV directly only with the first block you must find the first block, before the IV even becomes useful for your attack. Since the CBC mode uses AES(plaintext[i] XOR ciphertext[i-1], key) and you know the plaintext of the last block, as well as the ciphertext of the previous block you end up with a generic known-plaintext case. So what can you do?

You know AES(something XOR iv, key) = ciphertext[0] but since you don't know the plaintext or the key it might as well be AES(something, key) = ciphertext[0]. Knowing what (something) is won't help either since you'll simply end up with another known-plaintext scenario, so even if you got the first block of plaintext as well the key is unobtainable - that's the point of encryption, and a padding oracle is an issue with the mode of operation, not the algorithm itself.