0
$\begingroup$

Would appending a known string to the end of plain text then validating the string after decrypting adequately verify the authenticity of the cipher text?

$\endgroup$
2
$\begingroup$

Would appending a known string to the end of plain text then validating the string after decrypting adequately verify the authenticity of the cipher text?

No.

Here's what CBC-mode decryption looks like

enter image description here

Consider what happens if the attacker modifies the the first ciphertext block shown (as marked in red).

Then, the decryption of that block produces something unpredictable; that block turns into an unpredictable (by the attacker) value; the corresponding plaintext block is unpredictable.

For the second plaintext block, the modified first ciphertext block is xor'ed in with the unmodified decrypted second ciphertext block, the result is original plaintext block, except that the bits the attacker flipped in the ciphertext block will be flipped.

As for the rest of the decrypted plaintext, there are totally unchanged.

Hence, if you were to append a known string at the end, that part would decrypt properly, and hence your check would not detect the modifications done earlier.

$\endgroup$
  • $\begingroup$ Thanks for the answer. I forgot that CBC XORs with the encrypted value and not the plain text. $\endgroup$ – Westin Oct 13 '17 at 1:02
1
$\begingroup$

No.

Simple counter example:

Suppose we have a 3-block message: $M_1\|M_2\|S$. The third block $S$ will be our authentication string.

Now the CBC encryption will look like:

$\DeclareMathOperator{Enc}{\operatorname{Enc}}\DeclareMathOperator{IV}{\text{IV}}\DeclareMathOperator{Dec}{\operatorname{Dec}}$

$$\IV\|C_1=\Enc_k(\IV\oplus M_1)\|C_2=\Enc_k(C_1\oplus M_2)\|\Enc_k(C_2\oplus S)$$

Now note that if you XOR $\Delta$ into $C_1$, it only affects $M_1$ and $M_2$ and thus the authentication method was defeated.

$M_1'=\Dec_k(C_1\oplus \Delta)\oplus\IV$ and $M_2'=\Dec_k(C_2)\oplus C_1\oplus\Delta=C_1\oplus M_2\oplus C_1\oplus\Delta=M_2 \oplus\Delta$ and $S'=\Dec_k(C_3)\oplus C_2=S\oplus C_2\oplus C_2=S$

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.