> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfnote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfnote/crypto/aes/cbc-cca.md).

# CBC CCA

**CBC CCA** works when we are given a **decryption oracle**. Suppose we have a ciphertext that contains 2 blocks (32 bytes). Let $$m\_1, m\_2, c\_1, c\_2$$ denote plaintext block 1, plaintext block 2, ciphertext block 1, and ciphertext block 2, respectively. Feed this ciphertext into the decryption oracle, we get:

$$
m\_1 = Dec(c\_1) \oplus IV \ m\_2 = Dec(c\_2) \oplus c\_1
$$

Here is the trick: if we choose a ciphertext containing only null bytes, in other word, `c_1 = c_2 = b"\x00" * 16`, we will have:

$$
m\_1 \oplus m\_2 = Dec(0) \oplus Dec(0) \oplus 0 \oplus IV = IV
$$

And now the IV is recovered and we are done.