Say we have a sequence of N 16-byte plaintext blocks encrypted using AES in CBC mode, with an IV, resulting in N+1 16-byte ciphertext blocks. Can this ciphertext be manipulated in such a way that, once decrypted, the plain text would become shuffled (i.e. some of its N blocks become reordered), but with no other modifications otherwise?

Since each block depends on the previous one, if we just shuffle ciphertext blocks, some resulting plaintext blocks may become reordered, but at the cost of others being changed completely. One can also remove some M first blocks of ciphertext, which would make M first blocks of the plaintext disappear as well, but I see no way to append those ciphertext blocks to the end of the message to decrypt properly. Does there exist some other ciphertext manipulation which would result in reordering the plaintext blocks once decrypted, but with no other change otherwise?


1 Answer 1


It does not seem like this is possible. Consider the simple case where a 2 block (32 byte) plaintext message has been encrypted using AES-CBC with key $k$ and initialization vector $IV$. Let the plaintext blocks be referenced as $P_1$ and $P_2$, and let the corresponding ciphertext blocks be referenced as $C_1$ and $C_2$. In this case, knowing that $\text{AES.encrypt}(k, P_1 || P_2) = C_1 || C_2$ and that $\text{AES.decrypt}(k, C_1 || C_2) = P_1 || P_2$, you are trying to find out whether $\text{AES.decrypt}(k, f(C_1) || f(C_2))$ can possibly equal $P_2 || P_1$, where $f$ is some manipulating function applied to the ciphertext.

From the regular CBC decryption of $(C_1 || C_2)$ into $(P_1 || P_2)$, we are guaranteed the following relationships:

$\text{AES.decrypt}(k, C_2) \oplus C_1 = P_2$

$\text{AES.decrypt}(k, C_1) \oplus IV = P_1$

In order for $(f(C_1) || f(C_2))$ to decrypt into $(P_2 || P_1)$, the following relationships must be true:

$\text{AES.decrypt}(k, f(C_2)) \oplus f(C_1) = P1$

$\text{AES.decrypt}(k, f(C_1)) \oplus IV = P_2$

And then, by substitution, the following must also be true:

$\text{AES.decrypt}(k, f(C_2)) \oplus f(C_1) = \text{AES.decrypt}(k, C_1) \oplus IV$

$\text{AES.decrypt}(k, f(C_1)) \oplus IV = \text{AES.decrypt}(k, C_2) \oplus C_1$

In order for the first equation to be true, $f(C_2)$ must equal $C_1$ and $f(C_1)$ must equal $IV$, and in order for the second to be true as well, $f(C_1)$ must equal $C_2$ and $IV$ must equal $C_1$, giving us the following:

$f(C_2) = C_1$

$f(C_1) = C_2$

$f(C_1) = IV$

$C_1 = IV$

$f(C_1) = C_1 \rightarrow C_1 = C_2$

So the only way that you can manipulate blocks in the 32-byte AES-CBC output to decrypt to rearranged blocks of the original plaintext is if the output blocks $C_1$ and $C_2$ are identical. Clearly if this was the case, the corresponding input blocks would also be identical, and there would be no point for a malicious actor to rearrange them in the first place.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.