Encrypting any text without key after padding oracle attack in CBC mode Suppose the decryption program is already built. Now I want to encrypt an arbitrary plain text given the IV and the decryption program (no key). From the formulas, we have $$Dec(C_i)\oplus C_{i-1}=P_i$$ $$Dec(C_1)\oplus IV=P_1$$. However, given these information, I can only figure out $Dec(C_1)$. I have read this question, but it assumes all $Dec(C_i)$ are known, which is not correct for my case. My question is how can I find out all $C_i$? (Please note there isn't a database of $P_i$, $Dec(C_i)$ pairs to look up collisions).

I thought about using the decryption program to brute force each possibility, but it will take too long time. I also tried applying similar technique for decryption algorithm(tried to reverse the process), but still can't get a result. Any hints would be appreciated.
CBC encryption requires the encryption operation of the cipher, which cannot be build from just the decryption operation of the cipher. Your solution space is empty.

Padding oracle attacks let you find the plaintext without attacking the cipher itself. That's not the same as creating an encryption oracle.