Understanding AES CBC Mode and Error Propagation

The question asks about the impact of a single corrupted ciphertext block on the plaintext when using the Cipher Block Chaining (CBC) mode of the Advanced Encryption Standard (AES). The message consists of 50 AES blocks, and ciphertext block number 45 is corrupted during transmission.

How CBC Decryption Works

In CBC mode, each ciphertext block is dependent on the previous plaintext block and the current plaintext block during encryption. However, during decryption, the process is different and involves the previous ciphertext block:

• The decryption process for a given plaintext block $P_i$ uses the corresponding ciphertext block $C_i$ and the *previous* ciphertext block $C_{i-1}$.
• The decryption formula is: $ P_i = D_K(C_i) \oplus C_{i-1} $ where $D_K$ is the decryption function using key K.
• For the very first block ($P_1$), the previous ciphertext block ($C_0$) is the Initialization Vector (IV): $ P_1 = D_K(C_1) \oplus IV $

Crucially, the decryption of a plaintext block $P_i$ depends on the correct decryption of $C_i$ and the integrity of the previous ciphertext block $C_{i-1}$. It does not directly depend on the previously decrypted plaintext block ($P_{i-1}$).

Impact of Ciphertext Block Corruption ($C_{45}$)

Let's trace the effect of the corrupted ciphertext block $C_{45}$ (which Bob receives as $C'_{45}$) on the decrypted plaintext blocks:

• Decryption of $P_{44}$: This depends on $C_{44}$ and $C_{43}$. Since both are correctly received, $P_{44}$ is decrypted correctly. $ P_{44} = D_K(C_{44}) \oplus C_{43} $
• Decryption of $P_{45}$: Bob attempts to decrypt the corrupted block $C'_{45}$. The calculation is: $ P'_{45} = D_K(C'_{45}) \oplus C_{44} $ Since $C'_{45}$ is corrupted, the result of $D_K(C'_{45})$ will be incorrect. XORing this incorrect result with the correct $C_{44}$ yields an incorrect plaintext block $P'_{45}$. Thus, plaintext block 45 is corrupted.
• Decryption of $P_{46}$: This depends on the correct $C_{46}$ and the *received* $C'_{45}$. The calculation is: $ P'_{46} = D_K(C_{46}) \oplus C'_{45} $ While $D_K(C_{46})$ is calculated correctly (as $C_{46}$ is not corrupted), it is XORed with the corrupted ciphertext block $C'_{45}$. This operation scrambles the result, making $P'_{46}$ incorrect. Thus, plaintext block 46 is also corrupted.
• Decryption of $P_{47}$ and subsequent blocks: The decryption of $P_{47}$ depends on $C_{47}$ and the *correct* $C_{46}$: $ P_{47} = D_K(C_{47}) \oplus C_{46} $ Since both $C_{47}$ and $C_{46}$ were received correctly, the decryption of $P_{47}$ is correct. The error does not propagate further because the decryption of subsequent blocks relies only on correctly received ciphertext blocks.

Conclusion

A single corrupted ciphertext block in CBC mode affects the decryption of that specific block and the immediately following block. In this case, the corruption of ciphertext block 45 leads to the corruption of both plaintext block 45 and plaintext block 46.

Therefore, the total number of corrupted plaintext blocks is 2.