I was looking at the Wikipedia article about Block cipher mode of operation and I was wondering how can you from the encryption $C_i = E_K(P_i \oplus P_{i-1}\oplus C_{i-1})$ get the decryption $P_i = D_K(C_i) \oplus P_{i-1}\oplus C_{i-1}$ ?

Is there even a way to get decryption from encryption (and vice versa) or not?

  • 1
    $\begingroup$ Take the encryption equation, apply $D_K$ to both sides, solve for $P_i$. $\endgroup$ – Mikero Nov 9 '20 at 21:25
  • $\begingroup$ @Mikero Ok, but what is $D_K( E_K(P_i \oplus P_{i-1}\oplus C_{i-1}))$? I'm a beginner and I have no idea what should I get from this. $\endgroup$ – Jan Nov 9 '20 at 21:36
  • $\begingroup$ Oh, $D_K (E_K ( x))=x$, doesn't it? Ok, then I know how to solve this, thanks. $\endgroup$ – Jan Nov 9 '20 at 21:42

How the PPCBC mode works

Propagating Cipher Block Chaining mode of operation (PCBC) works as with message indexes starts from 1;

  • For PCBC encryption we have;

$$C_i = E_K(P_i \oplus P_{i-1}\oplus C_{i-1})\text{ and } \color{red}{C_0 = P_0 \oplus IV}$$

  • For PCBC decryption ve have;

$$P_i = D_K(C_i) \oplus P_{i-1}\oplus C_{i-1}\text{ and } \color{red}{C_0 = P_0 \oplus IV}$$

given $C_1$ to decrypt $P_1$

$$P_1 = D_K(C_1) \oplus P_{0}\oplus C_{0} = P_1$$

given $C_2$ to decrypt $P_2$

$$P_2 = D_K(C_2) \oplus P_{1} \oplus C_{1}$$ Now we can solce since we know, $P_1$ and we have all $C_i$s.

and so on...

The red part was missing in your question.

The Correctness of the PCBC mode

An encryption scheme must satisfy the correctness requirement; for every key $k$ output by the key generation algorithm and for every message $m \in \mathcal{M}$ ($\mathcal{M}$ is the message space), the following must hold;

$$ D_k(E_k(m)) = m$$

To see that PCBC has the correctness; take

$$C_i = E_K(P_i \oplus P_{i-1}\oplus C_{i-1})$$ take decryption on the both sides

$$D_K(C_i)= \color{red}{D_K}(\color{red}{E_K}(P_i \oplus P_{i-1}\oplus C_{i-1}))$$ cancel Enc with Dec.

$$D_K(C_i)= P_i \oplus P_{i-1}\oplus C_{i-1}$$


$$P_i = D_K(C_i) \oplus P_{i-1}\oplus C_{i-1}$$

Since we know, all $C_{i}$s, and previously decrypted $P_{i-1}$.

If it is the first case $(i=1)$, then we already know $\color{red}{C_0 = P_0 \oplus IV}$


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.