3

Say you have the secret message encrypted with AES-256 in CBC mode

5a04ec902686fb05a6b7a338b6e07760 14c4e6965fc2ed2cd358754494aceffa

where the first 16 Byte is the initial vector, the second 16 Byte is the ciphertext. The plaintext of the secret message above is (ASCII encoded) We're blown. Run

Now my question, how can you change the secret message such that you get the plaintext Meeting tonight! if you decrypt it?

I have tried to find some examples on the internet but I couldn't find any : /

However I could find a model that describes how CBC decryption works:

enter image description here

Our plaintext We're blown. Run is made up of 16 chracters which means we just have one plaintext block. From the model, we also see that the ciphertext is decrypted and XOR'd such that it creates the ciphertext. As it looks like, there are changes required in the initial vector so we get the desired message Meeting tonight!. But how is this done exactly?

Improve this question
5
  • Do you understand what the diagram is showing? If you do, I am pretty confident you should be able to work the answer out on your own with only a little bit of consideration. I'm guessing the point of this exercise is for you go through the deductive process of coming to an understanding on your own, not to simply Google for the right answer.
    – Stephen Touset
    Commented May 31, 2018 at 23:10
  • 1
    As a hint, you don't need to consider anything in that diagram besides the first block (since you don't have multiple blocks). And you know literally all of the components of that diagram (sans the key, which is irrelevant): the ciphertext, the IV, the plaintext, and the raw output of the decryption function (which can be calculated from the IV and plaintext).
    – Stephen Touset
    Commented May 31, 2018 at 23:13
  • As a further hint, what known value would the resulting plaintext be equal to if you set the IV to all zeroes? And what is the result of flipping a single bit of the IV?
    – Stephen Touset
    Commented May 31, 2018 at 23:14
  • @StephenTouset Ok so from the diagram we see that the initial vector only used for one XOR and this is done with the plaintext so it has only impact on this block. But if we look at encrypting diagram, we see that it changes the block of ciphertext... About zero initial vector, we need that because the first block doesn't have previous block and we set it zero so the mode can start at all. I understood this correct so far? By the way this is no homework I just try to find an example to understand the diagrams : /
    – eyesima
    Commented May 31, 2018 at 23:22
  • Crossposted on crypto which IMO is the (slightly) better place fro it
    – dave_thompson_085
    Commented Jun 1, 2018 at 4:04

1 Answer 1

Reset to default
5

You know the IV and the plaintext, as well as the raw cipher output (before the IV is applied). That is all that matters. You can ignore everything else. The only thing you can control is the ciphertext and the IV. So, how do you change the IV to predictably change the plaintext?

Hint: If you have A ⊕ B = C, and you know B and C (and thus can calculate A), what do you do to A, which you have full control over, to predictably change C? Here A is the plaintext before the IV gets applied, B is the IV, and C is the plaintext that you want to change. Note that, if you were doing this to any other block, the IV would instead be replaced with the previous block's ciphertext.

Improve this answer
9
  • 2
    Thank you very much for answer and hint! The first character of the plaintext is M, in ASCII this is 0x4d. The first byte of the initial vector is 0x5a. So we have 0x4d XOR 0x5a which equals 0x17. Thus the first byte of our manipulated initial vector (which will change the plaintext to Meeting tonight!) is 0x17 ?
    – eyesima
    Commented Jun 1, 2018 at 10:02
  • I didn't check the math but that should be right. Try it and find out!
    – forest
    Commented Jun 1, 2018 at 13:11
  • 1
    I would continue this till I worked through each character of the plaintext "Meeting tonight!". In the end I will have an initial vector which is different from the current one. But the ciphertext will be the same, right? How can I find out if I did it correctly? :)
    – eyesima
    Commented Jun 1, 2018 at 13:16
  • Do the encryption yourself! The openssl command line utility allows you to specify the key and IV directly as hex values. Any hex editor will allow you to view the ciphertext before and after. As far as I can tell, your method is correct, but it's always more enlightening to see the results with your own eyes.
    – forest
    Commented Jun 1, 2018 at 13:19
  • 1
    There may be some online AES encryption and decryption tools out there where you can input things like the plaintext, key, and IV. And it doesn't matter that they require a key. Just enter a random one and pretend you don't know it. After all, the point is that you can change the plaintext without using the key to do so. You get to play Alice, Bob, and Mallory! No need to fret because the role of Mallory involves not having access to some information Alice and Bob have!
    – forest
    Commented Jun 1, 2018 at 13:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .