How does CBC (Cipher Block Chaining) mode work?

In CBC mode, each plaintext block is XOR'd with the previous ciphertext block before encryption, creating a chain where each block depends on all preceding blocks.

* CBC XORs each block onto the previous ciphertext block before encrypting, chaining every block forward. *

Encryption:

C_0 = IV (Initialization Vector)
C_i = E(K, M_i ⊕ C_{i-1})

Decryption:

M_i = D(K, C_i) ⊕ C_{i-1}

Key properties:

• IV must be random and unpredictable for each message (but doesn't need to be secret)
• Identical plaintext blocks produce different ciphertext (because they're XOR'd with different previous blocks)
• A one-bit error in C_i corrupts M_i completely AND flips one bit in M_{i+1} (error propagation limited to 2 blocks)

Encryption is sequential (each block depends on the previous), but decryption is parallelizable (each block only needs C_{i-1}).

CBC is the most widely used mode for file/disk encryption and was the default in TLS until 1.3.

Go deeper:

• Block cipher mode of operation (Wikipedia) — CBC chaining, the IV requirement, and error behaviour.