CBC-R when IV unknown I've read the CBC-R description from Rizzo &amp; Duong but am having trouble understanding the sequence of steps that would be taken when the IV is unknown and is not included with the ciphertext.

Suppose I want to send a two-block ciphertext such that block 1 decrypts to garbage and block 2 decrypts to my desired plaintext. Would the following work? If so, why not?


Pick a desired plaintext, call this P
Create a random block, call this R1
Send the random block to a padding oracle decryption routine, call the result D1
XOR D1 with P, and make this block 1
Use R1 as block 2


Since the IV is unknown the first block becomes garbage, but the during decryption the next block should decrypt R1, yielding D1, then XOR it with my block 1 to get back to my desired plaintext. Am I looking at this correctly?

Side question: I assume plaintext (step 1) should include any padding sequence that the server expects, e.g. PKCS#7. Or should this be somehow applied during step 5?
Yes, you are correct. For padding - there's no way to fix it at step 5, you need to make correct padding at step 1.