I am a newbie to block cipher and when learning the CBC mode, I start to understand that an IV is being used in this mode and also will be transferred to the message receiver.

So here is my question, what if the IV is tampered? CBC mode can help to protect the integrity, but the IV is not encrypted, right?

  • You won't be able to decrypt the data. – Raimonds Liepiņš Sep 11 '19 at 8:21
  • Well, you won't be able to successfully decrypt the data. You'll have something, but it will be garbage. Depending on what the data is you may or may not be able to determine this easily. That's why GCM is preferred in many cases. If an attacker tampers with the IV you'll get an error during decryption. – Swashbuckler Sep 12 '19 at 17:28

AES-CBC only insures confidentiality, not integrity or authenticity.

If you look at the image down below, you can see how the Cipher Block Chaining Mode works for AES:

AES-CBC Decryption Schematic

Source: Wikimedia Commons

For now, let's ignore all the other blocks of data, padding, etc., and just focus on the first block of data. The ciphertext is decrypted with the key, and then XOR'd with the IV.

Since the attacker can freely modify the IV, the changes to the IV are directly, bit-for-bit, reflected in the decrypted text. This property is called Malleability. In fact, all the blocks are malleable, since you can modify any block of choice and it'll be XOR'd into the result of the next block. Yes, you will "lose" one block, but depending on how the data is structured, that may be okay.

Isn't this really dangerous?

Yes, which is why AES-CBC must be used in combination with a primitive that guarantees integrity and authenticity. That means, if either the IV or the Ciphertext are modified, the decryption will fail.

Or, you can use Authenticated Encryption, such as AES-GCM, which will do all of this for you.

| improve this answer | |
  • 1
    "the changes to the IV are directly, bit-for-bit, reflected in the decrypted text." This means that the first block of a CBC chiphertext is malleable. – A. Hersean Sep 11 '19 at 9:33
  • 1
    And not just the first block, every block is malleable so long as you don't mind scrambling the block before it. – AndrolGenhald Sep 11 '19 at 9:40
  • 1
    @AndrolGenhald Yes, that is also true, but with the first block you have the advantage that you can control the plaintext without any adverse effects. – MechMK1 Sep 11 '19 at 9:42
  • If you know that the recipient will discard a block, the next one is malleable (without adverse effects). – A. Hersean Sep 11 '19 at 9:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.