I need to cipher and decipher text with randomly access. For this I decided to use AES in CTR mode which is a good compromise between CBC and GCM.
But CTR mode is malleable. It is not a big problem because texts that I will cipher have not predefine patterns and I don’t need authentication, I just want to avoid the ability to read the plain text for an attacker.
However, I want to reduce the ability to an attacker to really use the malleability property of CTR.
Here my idea to do it:
public static void main() {
Key key = …;
IVParameterSpec iv = …;
int rSeed = …;
byte[] plainText = …;
AESBlock[] toCipher = cutIntoAESBlock(plainText);
for (AESBlock aesBlock : toCipher) {
byte[] shuffled = shuffle(aesBlock, rSeed);
byte[] encrypted = encryptAES_CTR(shuffled, key, iv);
…
byte[] decrypted = decryptAES_CTR(encrypted, key, iv);
byte[] unShuffled = unShuffle(decrypted, rSeed);
// Here the content of unShuffled must be equals to aesBlock content.
}
}
Suppose that methods shuffle(…)
and unShuffle(…)
are complementary and one reverse the other.
The shuffle step is here not to cipher a 128 bits AES block but just shuffle the order of bits of it in that way it reduces the impact of modifications done on the ciphered text by an attacker because if an attacker changes a part of the ciphered text, the modifications will be spread during the unShuffle phase and will change the content and the chance that the new content can be exploitable is reduced.
In that way, CTR mode is always malleable but ciphered text modifications impact are reduced.
It is just an idea and I write this post to know if this idea is really useful or if it is useless and just superficial step which does not reduce the impact of modifications that can be done by an attacker on the ciphered text.
I know that there is the GCM which provides authentication and therefore, is not malleable. But I don’t really need it and GCM cannot be accessed randomly especially if I want modify and re cipher just a part of the plain text.