Decryption formula of Plaintext Block Chaining (PBC) mode of a block cipher Considering that $C_n = E_k(M_n) \oplus M_{n-1}$ formula is used in encryption side of this mode of block cipher, and knowing that instead of M0 a randomly chosen initialization vector (IV) is used in Plaintext Block Chaining mode.
What would be the formula on the decryption side?

$M_n = D_k(C_n) \oplus M_{n-1}$

$M_n = D_k(C_n \oplus M_{n-1})$


Actually, I think as the algorithm has no access to $M$ bits on the decryption side, although I accept that by following $M$ bits, I will get to $M_0$ at the end which is IV and can solve the equations inversely from that point, it would be better to write the above equations as :

$M_n = D_k(C_n) \oplus D_k(C_{n-1})$

$M_n = D_k(C_n \oplus D_k(C_{n-1}))$


But my main question is which of the equation is correct if we want to represent the decryption side's formula?
let $$C_n = E_k(M_n) \oplus M_{n-1}$$ be the encrytion of the PBC mode with $M_0 = IV$
Then use the property of $\oplus$ and the correctness requirement of the encryption; for any key $k$ and every message $m$ in the message space it mus hold;
$$m = D_k(E_k(m))$$
\begin{align}
C_n &amp;= E_k(M_n) \oplus M_{n-1}\\
C_n \oplus M_{n-1} &amp;= E_k(M_n) \oplus M_{n-1} \oplus M_{n-1} &amp; &amp;;\text {x-or both sides with } M_{n-1} \\
C_n \oplus M_{n-1} &amp;= E_k(M_n) &amp; &amp;;\text{cancel}\\
D_k(C_n \oplus M_{n-1}) &amp;= D_k(E_k(M_n)) &amp; &amp;;\text{decrypt both sides} \\
D_k(C_n \oplus M_{n-1}) &amp;= M_n\\
\end{align}
Therefor to decrypt you need $M_n = D_k(C_n \oplus M_{n-1})$