# Correctness of Propagating Cipher Block Chaining mode of operation (PCBC)

I was looking at the Wikipedia article about Block cipher mode of operation and I was wondering how can you from the encryption $$C_i = E_K(P_i \oplus P_{i-1}\oplus C_{i-1})$$ get the decryption $$P_i = D_K(C_i) \oplus P_{i-1}\oplus C_{i-1}$$ ?

Is there even a way to get decryption from encryption (and vice versa) or not?

• Take the encryption equation, apply $D_K$ to both sides, solve for $P_i$. Nov 9 '20 at 21:25
• @Mikero Ok, but what is $D_K( E_K(P_i \oplus P_{i-1}\oplus C_{i-1}))$? I'm a beginner and I have no idea what should I get from this.
– Jan
Nov 9 '20 at 21:36
• Oh, $D_K (E_K ( x))=x$, doesn't it? Ok, then I know how to solve this, thanks.
– Jan
Nov 9 '20 at 21:42

How the PPCBC mode works

Propagating Cipher Block Chaining mode of operation (PCBC) works as with message indexes starts from 1;

• For PCBC encryption we have;

$$C_i = E_K(P_i \oplus P_{i-1}\oplus C_{i-1})\text{ and } \color{red}{C_0 = P_0 \oplus IV}$$

• For PCBC decryption ve have;

$$P_i = D_K(C_i) \oplus P_{i-1}\oplus C_{i-1}\text{ and } \color{red}{C_0 = P_0 \oplus IV}$$

given $$C_1$$ to decrypt $$P_1$$

$$P_1 = D_K(C_1) \oplus P_{0}\oplus C_{0} = P_1$$

given $$C_2$$ to decrypt $$P_2$$

$$P_2 = D_K(C_2) \oplus P_{1} \oplus C_{1}$$ Now we can solce since we know, $$P_1$$ and we have all $$C_i$$s.

and so on...

The red part was missing in your question.

The Correctness of the PCBC mode

An encryption scheme must satisfy the correctness requirement; for every key $$k$$ output by the key generation algorithm and for every message $$m \in \mathcal{M}$$ ($$\mathcal{M}$$ is the message space), the following must hold;

$$D_k(E_k(m)) = m$$

To see that PCBC has the correctness; take

$$C_i = E_K(P_i \oplus P_{i-1}\oplus C_{i-1})$$ take decryption on the both sides

$$D_K(C_i)= \color{red}{D_K}(\color{red}{E_K}(P_i \oplus P_{i-1}\oplus C_{i-1}))$$ cancel Enc with Dec.

$$D_K(C_i)= P_i \oplus P_{i-1}\oplus C_{i-1}$$

Therefore:

$$P_i = D_K(C_i) \oplus P_{i-1}\oplus C_{i-1}$$

Since we know, all $$C_{i}$$s, and previously decrypted $$P_{i-1}$$.

If it is the first case $$(i=1)$$, then we already know $$\color{red}{C_0 = P_0 \oplus IV}$$