# In use of AES CBC, can a cipher text signature be replaced with appending a known string to the plain text?

Would appending a known string to the end of plain text then validating the string after decrypting adequately verify the authenticity of the cipher text?

Would appending a known string to the end of plain text then validating the string after decrypting adequately verify the authenticity of the cipher text?

No.

Here's what CBC-mode decryption looks like

Consider what happens if the attacker modifies the the first ciphertext block shown (as marked in red).

Then, the decryption of that block produces something unpredictable; that block turns into an unpredictable (by the attacker) value; the corresponding plaintext block is unpredictable.

For the second plaintext block, the modified first ciphertext block is xor'ed in with the unmodified decrypted second ciphertext block, the result is original plaintext block, except that the bits the attacker flipped in the ciphertext block will be flipped.

As for the rest of the decrypted plaintext, there are totally unchanged.

Hence, if you were to append a known string at the end, that part would decrypt properly, and hence your check would not detect the modifications done earlier.

• Thanks for the answer. I forgot that CBC XORs with the encrypted value and not the plain text. – Westin Oct 13 '17 at 1:02

No.

Simple counter example:

Suppose we have a 3-block message: $M_1\|M_2\|S$. The third block $S$ will be our authentication string.

Now the CBC encryption will look like:

$\DeclareMathOperator{Enc}{\operatorname{Enc}}\DeclareMathOperator{IV}{\text{IV}}\DeclareMathOperator{Dec}{\operatorname{Dec}}$

$$\IV\|C_1=\Enc_k(\IV\oplus M_1)\|C_2=\Enc_k(C_1\oplus M_2)\|\Enc_k(C_2\oplus S)$$

Now note that if you XOR $\Delta$ into $C_1$, it only affects $M_1$ and $M_2$ and thus the authentication method was defeated.

$M_1'=\Dec_k(C_1\oplus \Delta)\oplus\IV$ and $M_2'=\Dec_k(C_2)\oplus C_1\oplus\Delta=C_1\oplus M_2\oplus C_1\oplus\Delta=M_2 \oplus\Delta$ and $S'=\Dec_k(C_3)\oplus C_2=S\oplus C_2\oplus C_2=S$