Decryption formula of Plaintext Block Chaining (PBC) mode of a block cipher

Considering that $$C_n = E_k(M_n) \oplus M_{n-1}$$ formula is used in encryption side of this mode of block cipher, and knowing that instead of M0 a randomly chosen initialization vector (IV) is used in Plaintext Block Chaining mode.

What would be the formula on the decryption side?

1. $$M_n = D_k(C_n) \oplus M_{n-1}$$

2. $$M_n = D_k(C_n \oplus M_{n-1})$$

Actually, I think as the algorithm has no access to $$M$$ bits on the decryption side, although I accept that by following $$M$$ bits, I will get to $$M_0$$ at the end which is IV and can solve the equations inversely from that point, it would be better to write the above equations as :

1. $$M_n = D_k(C_n) \oplus D_k(C_{n-1})$$

2. $$M_n = D_k(C_n \oplus D_k(C_{n-1}))$$

But my main question is which of the equation is correct if we want to represent the decryption side's formula?

• Why don't you just look at the Wikipedia or draw the picture? Not x-or is commutative operation. Jan 19 at 14:07
• @kelalaka If there were any answer to my question in Wikipedia, I wouldn't have typed this question here anyhow. Jan 19 at 14:39

let $$C_n = E_k(M_n) \oplus M_{n-1}$$ be the encrytion of the PBC mode with $$M_0 = IV$$

Then use the property of $$\oplus$$ and the correctness requirement of the encryption; for any key $$k$$ and every message $$m$$ in the message space it mus hold;

$$m = D_k(E_k(m))$$

\begin{align} C_n &= E_k(M_n) \oplus M_{n-1}\\ C_n \oplus M_{n-1} &= E_k(M_n) \oplus M_{n-1} \oplus M_{n-1} & &;\text {x-or both sides with } M_{n-1} \\ C_n \oplus M_{n-1} &= E_k(M_n) & &;\text{cancel}\\ D_k(C_n \oplus M_{n-1}) &= D_k(E_k(M_n)) & &;\text{decrypt both sides} \\ D_k(C_n \oplus M_{n-1}) &= M_n\\ \end{align}

Therefor to decrypt you need $$M_n = D_k(C_n \oplus M_{n-1})$$

• Thanks a lot. Can we substitute Mn-1 inside the decryption formula with Dk(Cn-1))? Jan 19 at 14:55
• You mean this? $M_n = D_k(C_n \oplus ( D_k(C_n \oplus M_{n-2})))$, of cource. Jan 19 at 14:56
• No, I mean instead of using M inside the decryption formula use the decrypted value of it so that the formula is changed to: $M_n = D_k(C_n \oplus D_k(C_{n-1}))$ Jan 19 at 15:03
• It is the same, since $M_i = D_k(C_i \oplus M_{i-1})$ then you $M_i$ to replace anywhere. It is just the chaining. Jan 19 at 15:07
• @Perfect. Thanks again. Jan 19 at 15:08

As this looks a lot like a learning exercise to me, and as the point of such exercises is to help you internalize and practice useful problem-solving methods, let me just provide a hint instead of spoon-feeding you the final answer.

Hint: Swap $$M \leftrightarrow C$$ and $$E \leftrightarrow D$$ in your encryption formula.

Do you recognize the resulting formula? (If not, check Wikipedia or your textbook.) What does that suggest the decryption formula for your mode should look like?

(Remember that, for a cipher mode to operate correctly, the encryption and decryption formulas must be inverses of each other, so that $$D_{k, IV}(E_{k, IV}(M)) = M$$ for all $$M$$.)

Ps. Bonus exercise: illustrate and/or prove why your "PBC" cipher mode is not secure. If you've already learned about ciphertext indistinguishability, describe how an adversary can win the IND-CPA game against it without breaking the underlying block cipher.

Alternatively, describe some other attack on this mode. For example, consider what would happen if the plaintexts were all highly repetitive, so that each plaintext block $$M_k$$ could only take one of a small number of possible values. Assume that the attacker knows what these possible values are, and that they might have access to a few ciphertexts with corresponding known plaintexts. Also describe why the same attack does not work e.g. on CBC mode.