# DES-CBC: Two ciphertext blocks c2 and c5 are equal. Why would this leak information?

Here, suppose that we were able to observe the ciphertext that we know had been encrypted in CBC mode, then how knowing of c2 and c5 ciphertext blocks would leak information ?

My professor asked us in the class and told us to think about it and gave us hint what would happen if we knew one of the plaintext blocks m2?

Ek = cipher "E" with key "k"

M# = Plaintext message block "M" number "#"

C# = Ciphertext block "C" number "#"

CBC mode is:

Cx = Ek(Mx XOR Cx-1), or in english: To get the cipher text for the current block number, you perform the keyed encryption of the value obtained by taking the plaintext message block of the same number, and xor'ing that against the previous numbered ciphertext block. That's the definition of CBC.

So if you have a series of CBC encoded blocks, and you realize that C2 and C5 are the same cipher text (ie, C2 = C5), you know:

C2 = Ek(M2 XOR C1)

C5 = Ek(M5 XOR C4)

And since C2 = C5, that means:

Ek(M2 XOR C1) = Ek(M5 XOR C4)

By the power of the maths, that means more importantly that you ALSO know:

AHA!:

(M2 XOR M5) = (C1 XOR C4)

Since you have been observing the ciphertexts, you not only know that C2 is equal to C5 but you've also captured C1 and C4 in your observations.

So you calculate (C1 XOR C4) and you have a value, which means you have a real number and not a variable on the right side of the equation marked "AHA!!".

That value is equal to (M2 XOR M5), as noted above.

So under your hypothetical, where your professor says you ALSO know plaintext M2, you are able to plug that in on the left side and solve.

You know that your known M2 XOR'd against your still unknown M5 equals the known value you calculated by taking the XOR of C1 and C4.

Back to basics. The magic of XOR is this:

If A XOR B = C, then B XOR C = A, AND A XOR C = B.

That's how RAID disk arrays with three disks work, by the way.

Result: Duplicate ciphertexts in CBC combined with a known plaintext corresponding to one of the blocks permits to you calculate the plaintext of the other matching ciphertext block.