I'm struggling with understanding this part of the literature:

It can be assumed that the entire ciphertext AND plaintext is known.

part of the literature

Considering the encryption method is $C_i = enc_k ( P_i \oplus C_{i-1})$ with a key k, and the decryption method is $P_i = dec_k(C_i) \oplus C_{i-1}$.

Why does it say in equation (2) say that we can generate the desired ciphertext of the previous block this way?

Also shouldn't the equation (3) formula be: $P'_{i-1} = ...$ instead of $P_{i-1} = ...$

I don't really get equation (4) and why is it different from equation (2)?

Any help appreciated.

  • $\begingroup$ This attack is using a decryption oracle without asking for decryption of $P_i$s. Did you look at the errata of the book? $\endgroup$
    – kelalaka
    Mar 13 '21 at 18:21
  • $\begingroup$ What is the name of the book? $\endgroup$
    – kelalaka
    Mar 13 '21 at 18:54
  • 1
    $\begingroup$ its from this paper: usenix.org/conference/usenixsecurity20/presentation/ender i dont think theres an errata $\endgroup$
    – hello3123
    Mar 13 '21 at 19:43


To better understand the attack on the paper, It is better to look at the original CBC-R attack to understand the above attack.

This work shows how to turn the padding oracle into an encryption oracle. With padding oracle, we can get decryption of any ciphertext.

Choose a random ciphertext $C_i$, actually, any ciphertext will work. Request decryption with the padding oracle $$P_i = Dec(C_i) \oplus C_{i-1}.$$ By controlling the $C_{i-1}$ we can turn $P_i$ to any value we want. The the target is $P_x$ than we can set $$C_{i-1} = P_x \oplus Dec(C_i).$$

As we know this will make the decryption of $C_{i-1}$ as a garbage block ( random block). But we started with a random block, too. Similarly, as the first step, request decryption then adjust the previous block;

$$C_{i-2} = P_{i-1} \oplus D(C_{i-1})$$ Here note that we request the decryption of $C_{i-1}$ with arbitrarily chosen $C_{i-2}$ then we adjust the $C_{i-2}$ so that the decryption is $P_{x-1}$. This is easy since it is just an x-or difference.

In this way, we repeat to the beginning where the last adjusted value is the nonce of the CBC mode.

This encryption oracle is very slow since it needs a padding oracle for the decryption of a block. The attack on the FPGA ( next title) is used directly by the decryption oracle and therefore it is very fast.

The Unpatchable Silicon: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

When a malicious action occurs the system halts, and the WBSTAR register is left intact, then after reboot, they read the WBSTAR register that stores what was decrypted and leaks 32-bits. Repeat to reveal all. This turns this bug into a decryption oracle on the FPGA.

HMAC key can also be decrypted using the above technique using the FPGA as a decryption oracle.

The aim is to turn the decryption oracle into an encryption oracle!

  1. Why does it say in equation (2) say that we can generate the desired ciphertext of the previous block this way?

Actually, it is the goal and they show it in the next steps. Therefore, you need to understand the next steps.

  1. Also shouldn't the equation (3) formula be: P′i−1=... instead of Pi−1=...

Yes it should be $P'_{i-1}$

Note that for arbitrary selected $C_i$ and $C_{i-1}$ using the decryption oracle one can find out $P_i$.

Now you want a value $P'_i$ in the FPGA and for this, you need the encryption of it $C'_i$.

$$P_i = dec_{KAES}(C_i) \oplus C_{i-1} \label{1}\tag{1}$$

If you set

$$C'_{i-1} = P_i \oplus C_{i-1} \oplus P'_i \label{2}\tag{2}$$

Then put values into equation \ref{1}

$$P_i = dec_{KAES}(C_i) \oplus P_i \oplus C'_{i-1} \oplus P'_i$$ leaves;

$$P'_i = dec_{KAES}(C_i) \oplus C'_{i-1} $$

CBC has the chaining so they need to modify to the beginning.

$$P'_{i-1} = dec_{KAES}(C'_{i-1}) \oplus C_{i-2} \label{3}\tag{3}$$

  1. I don't really get equation (4) and why is it different to equation (2)?

This is also a typo, since

$$C'_{i-2} = P_{i-1} \oplus C'_{i-2} \oplus P'_{i-1} \label{4}\tag{4}$$ leads

$$ P_{i-1} = P'_{i-1}$$

It should be

$$C'_{i-2} = P_{i-1} \oplus \color{red}{C_{i-2}} \oplus P'_{i-1}$$

Results of the article

  • This turns the decryption oracle into an encryption oracle. And using this a valid HMAC can be created, to.

  • So, a simple bug leads to a loss of confidentiality and integrity and authentication.

  • $\begingroup$ That you for your answer. i just have one question: Why is it: $P'_{i-1} = dec_{KAES}(C'_{i-1}) \oplus C_{i-2}$ instead of $P'_{i-1} = dec_{KAES}(C'_{i-1}) \oplus C'_{i-2}$? I though we want to repeat the whole process until we reach the first block $\endgroup$
    – hello3123
    Mar 14 '21 at 19:03
  • $\begingroup$ Alas, it is correct, combine the eq (4) and (3) to see that. I know, not a good way to write it down. $\endgroup$
    – kelalaka
    Mar 14 '21 at 19:50
  • $\begingroup$ @hello3123 to understand better the attack, looking the original source of the attack is better. Updated the answer. $\endgroup$
    – kelalaka
    Mar 15 '21 at 21:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.