I recently started studying cryptography and got interested in the subject. But I got this doubt when I was studying the encryption scheme. Even though we encrypt our message and change it into ciphertext, this ciphertext is still available to the attacker. So, what if the attacker modifies this ciphertext and sends it to the receiver? Then the receiver cannot decrypt the message right..?

  • $\begingroup$ What if an attacker just drops said message? $\endgroup$ – SEJPM Sep 11 '15 at 9:18

For a block cipher

A block cipher is a PRP, a Pseudo Random Permutation. That is: given a key it generates a permutation of all possible plaintext blocks to all possible ciphertext blocks. So there is a bijection between each plaintext block and each ciphertext block, i.e. each possible plaintext block is assigned its own ciphertext block. So there is a 1:1 relation between the plaintext block and the ciphertext block given a specific key.

This doesn't of course happen in practice, this is just a mathematical description. Instead each plaintext block that is inserted into the block cipher gets transformed into a single ciphertext given a specific key. Without the key you cannot reverse this process (unless the cipher is broken). It is of course also impossible to retrieve the key from the plaintext and ciphertext. Decryption performs the reverse operation.

Now what happens if we change a bit in one of the ciphertexts? Well, you get another ciphertext, which in turn maps to a different plaintext. This plaintext can be any of the remaining $2^{128}$ plaintext. As all possible 128 bit plaintext are possible you get one block of random garbage. The cipher just reverses the mapping without checking that you get the wrong plaintext block!

Now this explains what happens with a block cipher. How the change is otherwise handled depends on the mode of operation that the block cipher is used for (ECB, CBC, CFB, CTR etc). If you introduce errors in the ciphertext you would have to look at the error propagation property of the mode of operation.

If the block cipher is CBC and padding is applied then an attacker may have enough information to perform a padding oracle attack. This means that the attacker can use the unpadding performed by the receiver to quickly and completely find all the plaintext from the message without breaking the block cipher. So in this case introducing a modification of the ciphertext may give the attacker enough power to find out all information about the message - full loss of confidentiality!

For stream ciphers

For stream ciphers (that generate a key stream) the situation is significantly easier. With a stream cipher (or OTP) changing a single bit in the ciphertext simply changes the bit at the same location in the plaintext.

Preventing modifications

Modification by an attacker can of course not be prevented by any algorithm. What is possible though is to add an authentication tag to the ciphertext. An authentication tag is usually computed using a Message Authentication Code or MAC. By verifying the MAC against the plaintext or ciphertext the receiver can detect if the integrity of the message is still intact.

Many new protocols, including TLS 1.3, use so called authenticated ciphers. Authenticated ciphers always create an authentication tag internally. So it should always be possible to verify that the ciphertext is not changed in transit.

  • $\begingroup$ Anything still unclear, @Otaku? $\endgroup$ – Maarten Bodewes Sep 14 '15 at 15:04

So, what if the attacker modifies this ciphertext and sends it to the receiver?

This is a real possibility considered by most secure messaging schemes.

Then the receiver cannot decrypt the message right..?

Possibly, it depends on what exactly they changed. The attacker could easily send something that decrypted as random characters, or simply nothing. However, this may reveal the attacker's ability to intercept messages to the sender or receiver, allowing them to try other channels of communication, whilst the attacker has not learned much.

With a little more effort, the attacker could correctly guess something about the message and make a modification that would still technically decrypt, and might change something in a predicable way. E.g. they could guess that the main message was XORed using some kind of pseudo-random pad (a very common approach) and XOR in some modification where they think it would change the plaintext in a useful way when decrypted. E.g. if they guessed correctly the first word was "Attack", then they could change it to "Defend" or "Ignore" or any other 6-letter word . . .

To guard against such attacks, encrypted messages are usually also signed with a MAC, which the attacker would not be able to adjust correctly for their changes. So any modification would appear as an invalid signature and the recipient would know something was wrong.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.