# Modes of Operations Exercise

I am currently stuck at an exercise for my Cryptography Class in University which is:

Alice wants to send a message $M = (M_1,M_2) =$ "Pay Bob \$100 from bank accout$12345$" to her bank (encrypted). Therefore she picks a random Initial Value ($IV$) coded$(IV, M_1, M_2)$in 8-bit-ASCII, encrypts this and gets the Chiffre$C = (IV,C_1,C_2)$which she sends to her bank. Eve intercepts$C$from Alice and wants to change it to$C'=(IV',C_1',C_2')$with$M' =$"Pay Eve \$500 from bank account $12345$"

1. Give a valid $C'$ for $M'$ if Alice uses AES in Counter Mode
2. Give a valid $C'$ for $M'$ if Alice uses AES in CBC-Mode

The $IV$ is transferred with the messsage so Eve is able to change it anyway.

Maybe one of you can explain how to do this I don't have any Idea.

• Think about what happens in CBC if you flip one bit of the IV. Then think about what happens in counter mode if you flip one bit of the ciphertext. – mikeazo Jun 18 '14 at 12:31

$C_1=E_K(IV)\oplus P_1$
As you can see, there's a linear relation between the plaintext and the ciphertext. You now use $C_1$ (observed) and $P_1$ (known). You want to make $C'_1$ decrypt to $P_1'$. To obtain this you first construct $\Delta P=P_1\oplus P_1'$. Now you induce $\Delta P$ into the $C_1$, yielding $C_1'=C_1 \oplus \Delta P=C_1\oplus P_1' \oplus P_1=E_K(IV)\oplus P'_1 \oplus P_1 \oplus P_1=E_K(IV)\oplus P'_1$, meaning the plaintext is as desired.
Now observe how CBC-decryption works. $P_1=D_K(C_1)\oplus IV$. By applying the same $\Delta P$ as above to the $IV$, you reach the desired effect: $IV'=IV\oplus \Delta P \Rightarrow P'_1=D_K(C_1)\oplus IV \oplus \Delta P=P_1\oplus \Delta P$. As $\Delta P$ is constructed such that the message body is changed in the desired way, the desired change is done upon decryption.