I know that CBC is not secure against data modification. Can someone explain to me by illustrating at an example how I could change the last block if I have the encryption of "0"?
Thanks in advance
1
-
$\begingroup$ What do you mean by "change the last block"? If you want to change the last block of deciphered plaintext, just change the last block of ciphertext in any way and you are good to go, without needing the encryption of "0" (whatever that is). I suspect you are actually asked to change the last block of plaintext to something you know, or is it to something you choose. Both are easy, and require that you clarify exactly the encryption of what you plan to use towards that goal. But the later seems to require other changes in ciphertext and induce other changes in deciphered plaintext. $\endgroup$ – fgrieu♦ May 10 '18 at 21:18
Add a comment
|
$\begingroup$
$\endgroup$
If you flip bits in cipher text block $E_K(M_i)$ then you flip the same bits in $M_{i+1}$. If you know or guess the value of the last plaintext block then XOR the second to last ciphertext block with the guessed plaintext value. That makes it zero because $v \oplus v = 0$ for all v. It's not so easy to manipulate otherwise.
Edit: I misread encrypted "0" as set plaintext to zero
If $M_i$ is known to be zero then XORing $M_{i-1}$ with $v$ causes block i to decrypt to $v$ instead.
answered May 10 '18 at 20:56
$\begingroup$
$\endgroup$
To try and be a bit more specific and technical , I believe you are referring to the fact that CBC ciphertexts are not: one way under a chosen ciphertext attack. This means that given encryption and decryption oracles an adversary trying to break the scheme can decrypt a ciphertext
This is since given a ciphertext $c$ the adversary can pick a random encryption block $c^*$ and ask for the decryption of $cc^*$ to obtain $mm^*$. Therefore, they know $m$ is the original plaintext.
We can do this since CBC does not stop us modifying ciphertexts by just extending them.
