CBC Decryption via ECB Oracle

Updated 13 Sep 2026

• •

  What it is

  • •

    A technique for decrypting CBC-mode ciphertext using only an ECB decryption oracle, by exploiting the fact that CBC decryption is $P_i = D_K(C_i) \oplus C_{i-1}$ — the ECB oracle directly supplies $D_K(C_i)$ for any block you feed it.

• •

  When to apply

  • •

    You have an oracle that decrypts arbitrary blocks under ECB (no chaining) with the same key used to CBC-encrypt a separate target, and you know or can extract the target's IV (e.g. it's prepended to the ciphertext).

• •

  Math

  • •

    $P_i = D_K(C_i) \oplus C_{i-1}$​, with $C_0 = IV$.

• •

  Worked example

  • •

    Plaintext SECRET_BLOCK_ONESECRET_BLOCK_TWO (2 blocks), CBC-encrypted with a random IV. Feeding each ciphertext block through an ECB decrypt oracle and XORing with the preceding ciphertext block (IV for block 1) reconstructed the plaintext exactly, byte for byte.

• •

  Python

  • •

    plaintext = b""
    prev = iv
    for block in ciphertext_blocks:
        decrypted_block = ecb_decrypt_oracle(block)
        plaintext += xor(decrypted_block, prev)
        prev = block
    

• •

  Related

  • •

    AES

  • •

    ECB Byte-at-a-Time Decryption Attack

• •

  Cards

  • •

    What does an ECB decryption oracle actually give you when applied to a CBC ciphertext block?

    • •

      The raw block-cipher decryption $D_K(C_i)$, with no chaining XOR applied.

  • •

    What do you XOR $D_K(C_i)$ with to recover the true CBC plaintext block $P_i$?

    • •

      The previous ciphertext block $C_{i-1}$ (the IV for the first block).

◌ Explore connections in Graph view