Is it possible to perform CPA attack against CBC changing IV by last ciphertext block?

Question

I was trying to do a simple CPA attack against this scheme, to understand better the concept.

Instead of using a new 𝐼𝑉 each time, we decide to use the last block of the previous ciphertext as an initialization vector. Prove this new scheme is vulnerable to a chosen-plaintext attack.

So in this case,

• the challenger chooses a "game" and a key.
• After that, we send $(0\ldots 0,1\ldots 1)$
• and we receive $(IV, c)$.
• Now we send $(0\ldots 0, 0\ldots 0)$
• and we receive $(IV'=c , c')$.
• So if $c$ is equal to $IV'$ then the challenger is playing the left game, right otherwise.

Am I right? Am I confusing the concepts? When we talk about a block, is all the cipher or only the last bit?

Answer 1

The attack goes as follows, first the adversary asks for the encryption $(0…0,0…0)$. Then he gets $c_1=(c_{11},c_{12})=(IV,F_{K}(m_{\gamma_1}\oplus IV))=(IV,c=F_{K}(IV))$, since $m_{\gamma_1}=0…0$ regardless of the value of $\gamma$.  Then he asks for the encryption of $(m_{L_2}=0…0,m_{R_2}=c_{12}\oplus IV)$, and gets  $c_2=(c_{21},c_{22})=(F_{K}(IV),F_{K}(F_{K}(IV)\oplus m_{\gamma_2}))$. If $\gamma=L$, he gets $(F_{K}(IV),F_{K}(F_{K}(IV))$ and if $\gamma=R$ he gets $(F_{K}(IV),F_{K}(F_{K}(IV)\oplus c_{12}\oplus IV)=(F_{K}(IV),F_{K}(IV))$ since $c_{12}=F_{K}(IV)$.  In summary if $c_{21}=c_{22}$ he says $\gamma=R$ and he says $\gamma=L$ otherwise.