0
$\begingroup$

Let's suppose I encrypt a message with a block cipher in CBC mode, keep the key and IV secret and XOR a random block of data in each encrypted CBC block, being the XORed block the same for each CBC block (constant).

Does it add some encryption strength?

(I know this question is weird, but I need to know).

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

In general: No.

You have to assume the attacker knows what you are doing. That's Kerckhoffs' principle.

If your random blocks are actually a real One-Time-Pad on top of the block cipher, then it would be stronger - but you could achieve the same without the block cipher. If all your blocks use the same pad, this is true if the length is 1 block, the pad is truly random, only used once and communicated using another secure channel.

If you just mesh different things together to make it more complex - that does not add security at all.

As a side note: The IV in CBC is not secret. If you consider it secret, you need to clarify how the sender and receiver both know it. And following that - do you consider that secret as static and reuse it? That would violate the requirements of an IV.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Yes. Addition: In a known-plaintext attack, when the random block is secret, the best it achieves is increase security by 1 bit against key search (since we need to decipher two blocks instead of one to test a key) and increase by one block the amount of consecutive known plaintext needed. $\endgroup$
    – fgrieu ♦
    Commented May 25, 2021 at 7:10
  • $\begingroup$ @tylo -- I'm planning to write a disk encryption program in which the IV should be secret, I would use this algorithm (github.com/andrewhodel/nexor) Nexor, but it doesn't have a PRP in it and each encrypted block is constant (no privacy). $\endgroup$
    – phantomcraft
    Commented May 26, 2021 at 0:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.