How does CBC (Cipher Block Chaining) mode work?

In CBC mode, each plaintext block is XOR'd with the previous ciphertext block before encryption, creating a chain where each block depends on all preceding blocks.

* CBC XORs each block onto the previous ciphertext block before encrypting, chaining every block forward. *

Encryption:

$$\begin{aligned} C_0 &= IV \quad\text{(Initialization Vector)} \\ C_i &= E(K, M_i \oplus C_{i-1}) \end{aligned}$$

Decryption:

$$M_i = D(K, C_i) \oplus C_{i-1}$$

Key properties:

• IV must be random and unpredictable for each message (but doesn't need to be secret)
• Identical plaintext blocks produce different ciphertext (because they're XOR'd with different previous blocks)
• A one-bit error in $C_i$ corrupts $M_i$ completely AND flips one bit in $M_{i+1}$ (error propagation limited to 2 blocks)

Encryption is sequential (each block depends on the previous), but decryption is parallelizable (each block only needs $C_{i-1}$).

CBC is the most widely used mode for file/disk encryption and was the default in TLS until 1.3.

Go deeper:

• Block cipher mode of operation (Wikipedia) — CBC chaining, the IV requirement, and error behaviour.