# Modes of Operations Exercise

I am currently stuck at an exercise for my Cryptography Class in University which is:

Alice wants to send a message $M = (M_1,M_2) =$ "Pay Bob \$100 from bank accout$12345$" to her bank (encrypted). Therefore she picks a random Initial Value ($IV$) coded$(IV, M_1, M_2)$in 8-bit-ASCII, encrypts this and gets the Chiffre$C = (IV,C_1,C_2)$which she sends to her bank. Eve intercepts$C$from Alice and wants to change it to$C'=(IV',C_1',C_2')$with$M' =$"Pay Eve \$500 from bank account $12345$"

1. Give a valid $C'$ for $M'$ if Alice uses AES in Counter Mode
2. Give a valid $C'$ for $M'$ if Alice uses AES in CBC-Mode

The $IV$ is transferred with the messsage so Eve is able to change it anyway.

Maybe one of you can explain how to do this I don't have any Idea.

• Think about what happens in CBC if you flip one bit of the IV. Then think about what happens in counter mode if you flip one bit of the ciphertext. Commented Jun 18, 2014 at 12:31

$C_1=E_K(IV)\oplus P_1$
As you can see, there's a linear relation between the plaintext and the ciphertext. You now use $C_1$ (observed) and $P_1$ (known). You want to make $C'_1$ decrypt to $P_1'$. To obtain this you first construct $\Delta P=P_1\oplus P_1'$. Now you induce $\Delta P$ into the $C_1$, yielding $C_1'=C_1 \oplus \Delta P=C_1\oplus P_1' \oplus P_1=E_K(IV)\oplus P'_1 \oplus P_1 \oplus P_1=E_K(IV)\oplus P'_1$, meaning the plaintext is as desired.
Now observe how CBC-decryption works. $P_1=D_K(C_1)\oplus IV$. By applying the same $\Delta P$ as above to the $IV$, you reach the desired effect: $IV'=IV\oplus \Delta P \Rightarrow P'_1=D_K(C_1)\oplus IV \oplus \Delta P=P_1\oplus \Delta P$. As $\Delta P$ is constructed such that the message body is changed in the desired way, the desired change is done upon decryption.