CBC-R
To better understand the attack on the paper, It is better to look at the original CBC-R attack to understand the above attack.
This work shows how to turn the padding oracle into an encryption oracle. With padding oracle, we can get decryption of any ciphertext.
Choose a random ciphertext $C_i$, actually, any ciphertext will work. Request decryption with the padding oracle $$P_i = Dec(C_i) \oplus C_{i-1}.$$ By controlling the $C_{i-1}$ we can turn $P_i$ to any value we want. The the target is $P_x$ than we can set $$C_{i-1} = P_x \oplus Dec(C_i).$$
As we know this will make the decryption of $C_{i-1}$ as a garbage block ( random block). But we started with a random block, too. Similarly, as the first step, request decryption then adjust the previous block;
$$C_{i-2} = P_{i-1} \oplus D(C_{i-1})$$ Here note that we request the decryption of $C_{i-1}$ with arbitrarily chosen $C_{i-2}$ then we adjust the $C_{i-2}$ so that the decryption is $P_{x-1}$. This is easy since it is just an x-or difference.
In this way, we repeat to the beginning where the last adjusted value is the nonce of the CBC mode.
This encryption oracle is very slow since it needs a padding oracle for the decryption of a block. The attack on the FPGA ( next title) is used directly by the decryption oracle and therefore it is very fast.
The Unpatchable Silicon: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs
When a malicious action occurs the system halts, and the WBSTAR register is left intact, then after reboot, they read the WBSTAR register that stores what was decrypted and leaks 32-bits. Repeat to reveal all. This turns this bug into a decryption oracle on the FPGA.
HMAC key can also be decrypted using the above technique using the FPGA as a decryption oracle.
The aim is to turn the decryption oracle into an encryption oracle!
- Why does it say in equation (2) say that we can generate the desired ciphertext of the previous block this way?
Actually, it is the goal and they show it in the next steps. Therefore, you need to understand the next steps.
- Also shouldn't the equation (3) formula be: P′i−1=... instead of Pi−1=...
Yes it should be $P'_{i-1}$
Note that for arbitrary selected $C_i$ and $C_{i-1}$ using the decryption oracle one can find out $P_i$.
Now you want a value $P'_i$ in the FPGA and for this, you need the encryption of it $C'_i$.
$$P_i = dec_{KAES}(C_i) \oplus C_{i-1} \label{1}\tag{1}$$
If you set
$$C'_{i-1} = P_i \oplus C_{i-1} \oplus P'_i \label{2}\tag{2}$$
Then put values into equation \ref{1}
$$P_i = dec_{KAES}(C_i) \oplus P_i \oplus C'_{i-1} \oplus P'_i$$ leaves;
$$P'_i = dec_{KAES}(C_i) \oplus C'_{i-1} $$
CBC has the chaining so they need to modify to the beginning.
$$P'_{i-1} = dec_{KAES}(C'_{i-1}) \oplus C_{i-2} \label{3}\tag{3}$$
- I don't really get equation (4) and why is it different to equation (2)?
This is also a typo, since
$$C'_{i-2} = P_{i-1} \oplus C'_{i-2} \oplus P'_{i-1} \label{4}\tag{4}$$ leads
$$ P_{i-1} = P'_{i-1}$$
It should be
$$C'_{i-2} = P_{i-1} \oplus \color{red}{C_{i-2}} \oplus P'_{i-1}$$
Results of the article
This turns the decryption oracle into an encryption oracle. And using this a valid HMAC can be created, to.
So, a simple bug leads to a loss of confidentiality and integrity and authentication.
