Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Suppose Alice and Bob are communicating using a peer-reviewed symmetric encryption algorithm such as AES-256. Bob possesses a private encryption key to decode messages from Alice, but Alice does not have this key.
If Alice has plain text ready to encrypt and send to Bob, is it computationally feasible for Alice to produce cipher text that would be successfully decrypted by Bob without knowing his encryption key?
This depends on the block cipher mode that's used and/or any message authentication that the system may do. But plain old encryption-only modes likes AES-CBC and AES-CTR are vulnerable to malleability attacks, where an attacker who can get some ciphertext (or even better, ciphertext/plaintext pairs) is able to modify it to produce a message some aspects of whose decryption they can choose. There are practical examples of this, like the EFail attack:
The attacker changes an encrypted email in a particular way and sends this changed encrypted email to the victim. The victim's email client decrypts the email and loads any external content, thus exfiltrating the plaintext to the attacker.
[...] Because of the specifics of the CBC mode of operation, an attacker can precisely modify plaintext blocks if she knows the plaintext. S/MIME encrypted emails usually start with "Content-type: multipart/signed" so the attacker knows at least one full block of plaintext as shown in (a). She can then form a canonical plaintext block whose content is all zeros as shown in (b). We call the block pair X and C0 a CBC gadget. In step (c), she then repeatedly appends CBC gadgets to inject an image tag into the encrypted plaintext. This creates a single encrypted body part that exfiltrates its own plaintext when the user opens the attacker email.
None of this requires knowledge of the key.
The modern solution to this sort of thing is the use of Authenticated Encryption modes (aka "AEAD"), for example AES-GCM, that contain additional protections to detect and reject forged ciphertexts. But the use of this and other similarly modern algorithms is still not universal—for example EFail is an attack on S/MIME and PGP email which are older technologies but still widely used.
