Sign up ×

I have a hypothetical encryption scheme where somebody uses the one-time pad in CBC mode. That is, the block cipher is $E(k, m) :=k⊕m$, and that block cipher is used in CBC mode.

Now, I am assuming that a message $m=m_1||m_2||m_3||m_4$ is used for encryption.

How to compute $m_3⊕m_4$ from the resulting ciphertext (without using the key)?

Also: using this, how can I prove that it is IND_CPA insecure?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Remark: in One Time Pad the pad is used once, thus this is not OTP, since here $k$ is reused.

Hint for part 1: Write the relations between $k$, the message blocks $m_i$, the ciphertext blocks $\small C_i$ with the convention $\small\text{IV}=\small C_0$. Then, find equations that allow computing the desired $m_3⊕m_4$ from known quantities.

Hint for part 2, textbook variant: What is the definition that a cipher is not IND-CPA secure? Exhibit whatever that asks.

Hint for part 2, shortcut variant: IND-CPA implies that, for random plaintext, nothing can be learned about the plaintext given the ciphertext.

share|improve this answer

Your Answer


