Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently stuck at an exercise for my Cryptography Class in University which is:

Alice wants to send a message $M = (M_1,M_2) =$ "Pay Bob \$100 from bank accout $12345$" to her bank (encrypted). Therefore she picks a random Initial Value ($IV$) coded $(IV, M_1, M_2)$ in 8-bit-ASCII, encrypts this and gets the Chiffre $C = (IV,C_1,C_2)$ which she sends to her bank.

Eve intercepts $C$ from Alice and wants to change it to $C'=(IV',C_1',C_2')$ with $M' =$ "Pay Eve \$500 from bank account $12345$"

  1. Give a valid $C'$ for $M'$ if Alice uses AES in Counter Mode
  2. Give a valid $C'$ for $M'$ if Alice uses AES in CBC-Mode

The $IV$ is transferred with the messsage so Eve is able to change it anyway.

Maybe one of you can explain how to do this I don't have any Idea.

share|improve this question
Think about what happens in CBC if you flip one bit of the IV. Then think about what happens in counter mode if you flip one bit of the ciphertext. – mikeazo Jun 18 '14 at 12:31

I think it is now valid to answer this question as this course is likely to be over.

First observer how CTR-mode works:
$C_1=E_K(IV)\oplus P_1$

As you can see, there's a linear relation between the plaintext and the ciphertext. You now use $C_1$ (observed) and $P_1$ (known). You want to make $C'_1$ decrypt to $P_1'$. To obtain this you first construct $\Delta P=P_1\oplus P_1'$. Now you induce $\Delta P$ into the $C_1$, yielding $C_1'=C_1 \oplus \Delta P=C_1\oplus P_1' \oplus P_1=E_K(IV)\oplus P'_1 \oplus P_1 \oplus P_1=E_K(IV)\oplus P'_1$, meaning the plaintext is as desired.

Now observe how CBC-decryption works. $P_1=D_K(C_1)\oplus IV$. By applying the same $\Delta P$ as above to the $IV$, you reach the desired effect: $IV'=IV\oplus \Delta P \Rightarrow P'_1=D_K(C_1)\oplus IV \oplus \Delta P=P_1\oplus \Delta P$. As $\Delta P$ is constructed such that the message body is changed in the desired way, the desired change is done upon decryption.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.