Cipher block chaining (CBC) is a block-cipher mode that hides repeated plaintext-block patterns by chaining blocks together. Before encrypting a plaintext block, CBC XORs it with the preceding ciphertext block. Because a good ciphertext block appears random, that XOR masks patterns that would remain visible when identical blocks are encrypted independently in ECB mode. section 5.3
Figure 5.7 CBC mode XORs the plaintext of each block with the ciphertext of the previous block.
The chaining step feeds each ciphertext block into encryption of the next plaintext block. section 5.3
For a message with plaintext blocks P₁, P₂, … and ciphertext blocks C₁, C₂, …, CBC encrypts Cₙ = EncryptKey(Pₙ XOR Cₙ₋₁). The first block has no preceding ciphertext, so it uses an initialization vector: C₁ = EncryptKey(P₁ XOR IV). The IV travels with the ciphertext and is not secret, but a new, unique IV is required for each message. section 5.3 section 5.6
Decryption reverses the order of operations: decrypt the current ciphertext block, then XOR that result with the preceding ciphertext block or IV. Thus Pₙ = Cₙ₋₁ XOR DecryptKey(Cₙ). This dependence means that modifying a preceding ciphertext block predictably changes the following plaintext block after decryption. section 5.3 section 5.4.2
Figure 5.11 Decryption of two consecutive blocks using CBC
The two-block decryption path shows where the preceding ciphertext block is XORed into the recovered plaintext. section 5.4.2
A CBC implementation handling arbitrary-length messages typically needs to:
- Pad plaintext to the block size, such as with PKCS#7. section 5.4.1
- Generate a random IV, initialize encryption with it, and prepend the IV to the transmitted ciphertext. section 5.4.1
- Extract the prepended IV before decryption, decrypt blocks, validate padding, remove it, and parse the resulting plaintext. section 5.4.1
Encrypted timestamp service
An AES-CBC service encrypts a UnixDate timestamp after PKCS#7 padding, returns IV || ciphertext, then later extracts the IV and decrypts the submitted value. If its responses reveal whether padding was valid, a client can alter a preceding ciphertext byte, brute-force a valid padding byte, recover an intermediate value, and derive plaintext bytes. The failure is the padding-validity oracle, not a need to break AES. section 5.4.1 section 5.4.2
CBC also requires care across requests. Reusing the prior request’s final ciphertext block as the next IV was exploited by BEAST against older browser SSL/TLS traffic: an attacker able to trigger requests and observe encrypted traffic could target HTTP cookies. Generate a new IV for every message, and do not expose distinct errors that reveal decrypted padding validity. section 5.5 section 5.5.1 section 5.6
