Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Perhaps I don't understand the answers to Malleability attacks against encryption without authentication, so trying to be more concrete... please be patient.

If I want to change the first block and I can change the IV, I see that its easy to change the IV to IV xor old_block_0 xor new_block_0 and the first block would change.

However, if I want to change the second block block_1, I don't understand how can I do it? If I change the block before it to block_0 xor x I would garble the D(block_0), won't I?

share|improve this question
The malleability attack on CBC mode does garble the previous block. $\;$ – Ricky Demer Feb 1 '14 at 21:09
@RickyDemer - rephrased, hope its clearer now – ihadanny Feb 1 '14 at 21:20
If you change the block before it to block_0 xor x then you would indeed "destroy" the D(block_0), if "destroy" means garble. $\;$ – Ricky Demer Feb 1 '14 at 21:26
ok :) I sense that I'm missing something basic and making you guys angry. Will think about it some more before bothering the community. Thanks! – ihadanny Feb 1 '14 at 21:35
Maybe some people had a "meh" moment, but if this question was not asked yet, I don't think there is too much wrong with the question. – Maarten Bodewes Feb 2 '14 at 12:09

Depending on how malleability is defined, the question actually has some merit.

Given to the Wikipedia definition of malleability, a cipher is malleable if there exists at least one function $g$ over the set of possible cipher texts, and one function $f$ over the set of possible plain texts, such that given any cipher text $c_0$, the cipher text $c_1 = g(c_0)$ will decrypt to $D_k(c_1) = f(D_k(c_0))$ regardless of which key $k$ is used for the decryption.

Given that a function by definition assigns a unique value to each argument, there only exists such a function $f$ for CBC mode that might be known in advance to the attacker and might be determined from $g$ alone, if the corresponding function $g$ only modifies the IV. If the function $g$ modifies any other block, then $f$ will either be a relation (i.e. assign a set of possible values to each argument, rather than a unique value), or it will be a function that depends also on the key $k$.

Still, non-malleability might be defined in such way that the function $f$ only has to exist, without necessarily being known to the attacker in advance. If non-malleability is defined in such way, it is not necessarily a problem that this might imply that $f$ depends also on the unknown key and not just on $g$ and the plain text.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.