I would like to know if it is mathematically feasible to change an AES(CBC) ciphertext and IV without owning the key, so that the ciphertext would look totally different while still decrypting to the same original message?

Just a random crazy thought that popped up in my mind, not even sure if it makes any sense...

  • I think there should be a one-to-one mapping between clear text and cypher text (since many-to-one would either mean that multiple cyphers map on the same cleartext (which makes the cyphers longer than necessary) or would mean that mulitple cleartexts map on the same cypher which would inhibit you from decoding them). So only on cypher text should exist for one clear text. I don't know if that is actually the case in AES. You can always encrypt the cypher text again. The new cypher text will be entirely different from the original one. However it won't simply decrypt in one step. – Silver Jun 30 '16 at 10:46
  • You want a "probabilistic" encryption system. AES is not one of them. – deviantfan Jun 30 '16 at 11:43
  • Can you be more specific? If you want to just change ciphertext and IV, but still be able to use the same key and obtain the same message then it's not possible. If you want to change ciphertext and IV, and be able to decrypt the original message with some different key then I guess it's possible but the odds are the same as guessing the key for some AES ciphertext. Also, could you clarify if you're just talking about shuffling or changing? If it's shuffling, it's shuffling blocks, bytes or bits? – Mr. E Jun 30 '16 at 14:30
  • @Silver If you encrypt the same plaintext twice with different IVs, then you'll get different ciphertexts. – Macil Jun 30 '16 at 21:51
  • @AgentME I'm not all that into crypto, can you tell me where the IVs are coming from? Is this generated based on the key? – Silver Jul 1 '16 at 7:17

No, this is not possible. If you change a single bit in a block that is put through the cipher then all bits change with a certainty of 50% (each) due to the avalanche effect. So even though only one bit will be changed in the next block, the current block will still "completely" change.

Differently said, AES is a block cipher and a keyed block cipher is a pseudo random permutation. If you change even a single bit you get another mapping to an entirely different value for that block. Only one block leads to the same plaintext block, there is no redundancy. Because of the pseudo-randomness you get an entirely different plaintext block, no matter how many bits you change.

Some padding modes are redundant though (the most common one, PKCS#7 compatible padding isn't). So there is a chance that an attacker can change the last few bytes of the plaintext. For instance, you'd have a ~ 1 / 65536 chance that you'd create an ISO 10126 padded message that is identical after unpadding (the first byte identical and the last byte indicating 15 padding bytes).

Obviously using an authentication tag / message authentication code (MAC) over the ciphertext should be considered to be secure against any of these attacks.


This is impossible as @mr-e said: CBC works by XORing the plaintext with the IV / previous ciphertext before encryption. Without access to the ciphertext you cannot alter the rounds.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.