I understand that if a system uses AES in CTR mode (or other modes) without authentication that an attacker can flip bits to try to get the system to do something it wasn't intended to do (or wasn't intended for the attacker specifically to do).

What is not so clear is, does the lack of authentication mean that the attacker can somehow recover the plain text? I'm specifically thinking of a case where firmware is encrypted with AES-CTR but has no authentication. The attacker can take publicly available encrypted firmware intended for the device, alter it, and send it to the device. Is the attacker somehow able to decrypt the firmware by doing this?

  • $\begingroup$ That depends on everything. ​ (For example, what's the programming language, $\hspace{1.47 in}$ and how are its programs represented as bitstrings?) ​ ​ ​ ​ $\endgroup$ – user991 Oct 19 '16 at 5:18
  • $\begingroup$ What I have in mind is a binary file (representing the opcodes for a microcontroller). Why does that matter? $\endgroup$ – freefall83 Oct 19 '16 at 5:42
  • $\begingroup$ The AES CTR mode encryption may not on its own allow the adversary to recover (parts of) the plaintext. However, being able to flip bits in the firmware and see how it affects the system may signal information about the plaintext to the adversary. $\endgroup$ – Guut Boy Oct 19 '16 at 6:37
  • $\begingroup$ [Guut Boy's comment], which is why the set of opcodes and how they are represented as bitstrings matters. ​ ​ $\endgroup$ – user991 Oct 19 '16 at 7:01
  • $\begingroup$ If an attacker can alter the firmware he can probably just turn off all security measures which prevent him from dumping the firmware at runtime. $\endgroup$ – SEJPM Oct 19 '16 at 12:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.