Are there equivalent IVs in DES/CBC?

Question

I'm playing around with the CryptoPP library with DES/CBC and I've noticed that for some sets of data, if I decrypt the ciphertext with Key1, IV1, I get a good cleartext result -- but if I decrypt the same ciphertext with Key1, IV2, I get the identical good cleartext result.

I find this very surprising. So much so, that I think I'm doing something wrong.

I want to check my assumptions: I've been under the impression that changing even 1 bit of the IV will alter the decryption result. Is this not true?

Is there such a thing as an "equivalent" IV?

Answer 1

During CBC mode decryption, each ciphertext block is first decrypted with the block cipher, and then the first decrypted block is XORed with the IV, while later blocks are XORed with the previous ciphertext block:

Thus, the first block of plaintext is computed as: $$P_1 = IV \oplus D_K(C_1).$$

Equivalently, we may solve this equation for $IV$ to obtain: $$IV = P_1 \oplus D_K(C_1).$$

This means that, for any ciphertext and key, it's always possible to choose the IV so that the first block will decrypt to any plaintext we want.

---

This also implies that CBC mode is trivially malleable: an attacker who can modify the encrypted message can flip arbitrary bits in the first block of the plaintext simply by flipping the corresponding bits of the IV. In particular, if the attacker can guess the original first block of plaintext, they can rewrite it to say whatever they want without knowing the key. (A similar attack is possible for later blocks, but it tends to randomly scramble the previous block of plaintext.)

Such malleability is a general feature of CBC and all other non-authenticating cipher modes. To protect against it, it is necessary to verify the integrity of the ciphertext using a MAC, or to use a combined authenticated encryption mode.