We have a python program that encrypts/decrypts plaintext given in hex to a cipher using AES CBC. We know that the IV is the same and is not going to change (it is stored in a file). How can we possibly find the IV, if found this will be the flag.

  • $\begingroup$ Hint: removed the first block, and see the new equations of decryption from the oracle and actual one! $\endgroup$
    – kelalaka
    Feb 26, 2021 at 12:01
  • $\begingroup$ The first block of what? $\endgroup$
    – tanngo
    Feb 26, 2021 at 12:44
  • $\begingroup$ If I wrote a little longer that will make a problem for the CTF? If not I'll extend it! $\endgroup$
    – kelalaka
    Feb 26, 2021 at 12:46
  • $\begingroup$ It will not create a problem, It just for me the know how this is done $\endgroup$
    – tanngo
    Feb 26, 2021 at 12:53

1 Answer 1


Request decryption for three blocks ( 2 is enough);

\begin{align} P_1 =& Dec_k(C_0) \oplus IV\\ P_2 =& Dec_k(C_1) \oplus C_{0}\\ P_3 =& Dec_k(C_2) \oplus C_{1}\\ \end{align}

Now remove the first ciphertext, and request decryption;

\begin{align} P'_2 =& Dec_k(C_1) \oplus IV\\ P_3 =& Dec_k(C_2) \oplus C_{1}\\ \end{align}

Now use the equations of $P_2$ and $P'_2$

$$\begin{align} P_2 \oplus P'_2 &= Dec_k(C_1) \oplus C_{0} \oplus Dec_k(C_1) \oplus IV\\ & = C_{0} \oplus IV \\ P_2 \oplus P'_2 \oplus C_{0} &= IV \\ \end{align}$$

In programmer aspect

defn CBCDecryptionOracle(c[]):
   return Dec(c[])

c = (c0,c1)

(p1,p2) = CBCDecryptionOracle(c)

p2' = CBCDecryptionOracle(c1)

print( p2 ^ p2' ^ c[0])

Note: you may need to find the size of c1 (that means the size of the block used in AES-CBC mode).

  • $\begingroup$ I'm a programmer not a mathematician ;) Could you provide this with an example please? $\endgroup$
    – tanngo
    Feb 26, 2021 at 13:00
  • $\begingroup$ Request 2 decryption of two blocks then you have $P_1,P_2,C_1,C_2$ in your hands but the IV is missing. Now remove the first ciphertext and request decryption then you have a new $P'_2$ which is different. Now use what you have in your hand $P_2\oplus P'_2 \oplus C_0$ to obtain the IV. $\endgroup$
    – kelalaka
    Feb 26, 2021 at 13:04
  • $\begingroup$ Given the following: P1 = FooBar (46 6f 6f 42 61 72) C1 = 86c865a3b6fc2e5e7b8423e8ec7f48f3 P2 = JohnDoe (4a 6f 68 6e 44 6f 65) C2 = 338bcd8c0465d066843a6a7dc10abac6 P3 = AliceBob (41 6c 69 63 65 42 6f 62) C3 = f8cbf44f53a6b362cf683324eb2bd44a $\endgroup$
    – tanngo
    Feb 26, 2021 at 13:20
  • 1
    $\begingroup$ You should encrypt a message that must have longer than 1 block of the AES so that you can use the proposed method. $\endgroup$
    – kelalaka
    Feb 26, 2021 at 13:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.