I'm struggling with understanding this part of the literature: It can be assumed that the entire ciphertext AND plaintext is known. [![part of the literature][1]][1] [1]: https://i.sstatic.net/rSUF9.png Considering the encryption method is $C_i = enc_k ( P_i \oplus C_{i-1})$ with a key k, and the decryption method is $P_i = dec_k(C_i) \oplus C_{i-1}$. Why does it say in equation (2) say that we can generate the desired ciphertext of the previous block this way? Also shouldn't the equation (3) formula be: $P'_{i-1} = ...$ instead of $P_{i-1} = ...$ I don't really get equation (4) and why is it different from equation (2)? Any help appreciated.