IND-CPA security of mode of operation using triple AES with plaintext || IV+counter I have found this figure of a mode of operation using a triple AES with m||IV+ctr input:


I suppose it's a custom mode of operation since I haven't seen it anywhere else. My question is if it is IND-CPA, and how to prove it in an adversarial model?
Seems to me that if you just look at the first layer that uses K1 that you can already show that it is CPA secure. After all, if the IV is always unique then $M_n \| IV + n - 1$ is always unique in this scheme. So then the input to the $\text{AES}_{K_1}$ block cipher is also unique. This makes the scheme have the same properties as the key stream of Counter Mode, with $IV + n - 1$ is the counter.

So unless $K_1$ is reused within the scheme, the scheme must be secure - regardless of any other encryption operations.



Now one thing to notice with the above reasoning is that I've proved it to be secure given key $K_1$. If you expect it to have a security of the 3 keys together (e.g. 128 x 3 = 384 bits for AES-128) then you may need to read up on meet in the middle attacks. At most the security will be 256 bits - that is if we don't put any constraints on memory usage. That's a separate security issue than IND-CPA though.



Of course, when it comes to practicality, this is one of the worst schemes you can think of. The number of key bits and operations is tripled to achieve additional security of about two times specified. More importantly, you'd also need more encryption operations as the IV takes away message space from each message block. The ciphertext also expands with the same factor.