# Finding the IV of AES CBC (CTF)

We have a python program that encrypts/decrypts plaintext given in hex to a cipher using AES CBC. We know that the IV is the same and is not going to change (it is stored in a file). How can we possibly find the IV, if found this will be the flag.

• Hint: removed the first block, and see the new equations of decryption from the oracle and actual one! – kelalaka Feb 26 at 12:01
• The first block of what? – tanngo Feb 26 at 12:44
• If I wrote a little longer that will make a problem for the CTF? If not I'll extend it! – kelalaka Feb 26 at 12:46
• It will not create a problem, It just for me the know how this is done – tanngo Feb 26 at 12:53

Request decryption for three blocks ( 2 is enough);

\begin{align} P_1 =& Dec_k(C_1) \oplus IV\\ P_2 =& Dec_k(C_1) \oplus C_{0}\\ P_3 =& Dec_k(C_2) \oplus C_{1}\\ \end{align}

Now remove the first ciphertext, and request decryption;

\begin{align} P'_2 =& Dec_k(C_1) \oplus IV\\ P_3 =& Dec_k(C_2) \oplus C_{1}\\ \end{align}

Now use the equations of $$P_2$$ and $$P'_2$$

\begin{align} P_2 \oplus P'_2 &= Dec_k(C_1) \oplus C_{0} \oplus Dec_k(C_1) \oplus IV\\ & = C_{0} \oplus IV \\ P_2 \oplus P'_2 \oplus C_{0} &= IV \\ \end{align}

In programmer aspect

defn CBCDecryptionOracle(c[]):
return Dec(c[])

c = (c1,c2)

p1 = CBCDecryptionOracle(c)

d = c[0]

p2 = CBCDecryptionOracle(d)

print( p1[0] ^ p2 ^ c0)


• I'm a programmer not a mathematician ;) Could you provide this with an example please? – tanngo Feb 26 at 13:00
• Request 2 decryption of two blocks then you have $P_1,P_2,C_1,C_2$ in your hands but the IV is missing. Now remove the first ciphertext and request decryption then you have a new $P'_2$ which is different. Now use what you have in your hand $P_2\oplus P'_2 \oplus C_0$ to obtain the IV. – kelalaka Feb 26 at 13:04
• Given the following: P1 = FooBar (46 6f 6f 42 61 72) C1 = 86c865a3b6fc2e5e7b8423e8ec7f48f3 P2 = JohnDoe (4a 6f 68 6e 44 6f 65) C2 = 338bcd8c0465d066843a6a7dc10abac6 P3 = AliceBob (41 6c 69 63 65 42 6f 62) C3 = f8cbf44f53a6b362cf683324eb2bd44a – tanngo Feb 26 at 13:20
• You should encrypt a message that must have longer than 1 block of the AES so that you can use the proposed method. – kelalaka Feb 26 at 13:28