# An exercise to show that CBC Chain is insecure

The CBC-Chain mode of operation is a CBC variant in which the IV that is used for the very first message to be encrypted is randomly selected, whereas the IV used for each subsequent encrypted message is the last block of ciphertext that was generated. Show that CBC-Chain is insecure by constructing an efficient IND$-CPA adversary. My Approach: Designing an adversary Query $$0^n$$, get $$C_1=E_k(IV)$$. Query $$C_1$$, get $$C_2=E_k(0^n)$$. Now if we query $$C_2||m_1||m_2||\dots$$ Then encrypted text will be $$C_1'||C_2||C_3'||\dots$$ where $$C_2=C_1'$$ Hence CBC chain mode is insecure. This is what I have tried, don't know if it's correct, any help with the answer will be truly appreciated. Here the Adv is 1 in terms of IND-CPA, Can anyone write down the IND$-CPA with Adv equals 1.

Adversary $$A^{\epsilon_k(LR(.,.,b))}$$

$$M_{0,1}\leftarrow 0^n; M_{1,1} \leftarrow 0^n$$

$$M_{0,2} \leftarrow 0^n; M_{1,2} \leftarrow 0^{n-1}1$$

$$ \stackrel{}{\leftarrow} \epsilon_k(LR(M_{0,1}, M_{1,1}, b))$$

$$ \stackrel{}{\leftarrow} \epsilon_k(LR(M_{0,2}, M_{1,2}, b))$$

If $$C_1=C_2$$ then return 1 else return 0.

• Isn't $C_1' = C_1$ – kelalaka Feb 11 at 13:10
• Not necessarily. – Sayantan Feb 11 at 13:14
• I'm a bit confused, what is $C_1'$? Also if this is for an assignment, you probably want to clearly state what your adversary outputs when i.e. 0 or 1. – SEJPM Feb 11 at 13:15
• I suggest that you describe in detail the experiment that the adversary you are trying to build is interacting with. The adversary that you propose must fit that experiment, and I'm afraid that the currently proposed adversary does not, for failing to make guesses. In the IND-CPA game (without \$), the adversary repeatedly submits two plaintexts and tries to guess which got encrypted (decided at random). From what I get of IND\$-CPA, the adversary repeatedly submits one plaintext, and tries to guess if it got encrypted or if the query returned a random string (decided at random). – fgrieu Feb 11 at 13:15
• Also, it is better to define the CBC-chain with equations, too. – kelalaka Feb 11 at 13:22