I was trying to do a simple CPA attack against this scheme, to understand better the concept.

Instead of using a new 𝐼𝑉 each time, we decide to use the last block of the previous ciphertext as an initialization vector. Prove this new scheme is vulnerable to a chosen-plaintext attack.

So in this case,

  • the challenger chooses a "game" and a key.
  • After that, we send $(0\ldots 0,1\ldots 1)$
  • and we receive $(IV, c)$.
  • Now we send $(0\ldots 0, 0\ldots 0)$
  • and we receive $(IV'=c , c')$.
  • So if $c$ is equal to $IV'$ then the challenger is playing the left game, right otherwise.

Am I right? Am I confusing the concepts? When we talk about a block, is all the cipher or only the last bit?

  • $\begingroup$ This game is problematic since the first IV generation is not clear. Anyway, assuming that is random for the first time, you need to send $(1\ldots 1)$ as the first data on the second try. Write CBC equations and see better? ( note that you seem to send two blocks) $\endgroup$
    – kelalaka
    Feb 21, 2022 at 18:38
  • $\begingroup$ I don't really see a connection to guess the game. The first time I send the message, I will recive (IV, F(k,mi xor ci-1)), second time ( F(k,mi xor ci-1), F(k,mi' xor ci-1')). I guess I'm missing something required to solve the attack. $\endgroup$ Feb 21, 2022 at 20:47
  • $\begingroup$ maybe I just get it, if I do the cipher of the second try XOR with the IV of the first try, I will get the message of the second try? $\endgroup$ Feb 21, 2022 at 21:02
  • $\begingroup$ Send $((c \oplus IV), (1\ldots 1)$ on the second time? $\endgroup$
    – kelalaka
    Feb 21, 2022 at 21:02
  • $\begingroup$ If this is not homework can you write an answer to your question? $\endgroup$
    – kelalaka
    Feb 21, 2022 at 21:11

1 Answer 1


The attack goes as follows, first the adversary asks for the encryption $(0…0,0…0)$. Then he gets $c_1=(c_{11},c_{12})=(IV,F_{K}(m_{\gamma_1}\oplus IV))=(IV,c=F_{K}(IV))$, since $m_{\gamma_1}=0…0$ regardless of the value of $\gamma$.  Then he asks for the encryption of $(m_{L_2}=0…0,m_{R_2}=c_{12}\oplus IV)$, and gets  $c_2=(c_{21},c_{22})=(F_{K}(IV),F_{K}(F_{K}(IV)\oplus m_{\gamma_2}))$. If $\gamma=L$, he gets $(F_{K}(IV),F_{K}(F_{K}(IV))$ and if $\gamma=R$ he gets $(F_{K}(IV),F_{K}(F_{K}(IV)\oplus c_{12}\oplus IV)=(F_{K}(IV),F_{K}(IV))$ since $c_{12}=F_{K}(IV)$.  In summary if $c_{21}=c_{22}$ he says $\gamma=R$ and he says $\gamma=L$ otherwise.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.