I would like to simulate the CBC IV attack where the IV is predictable. It's described in the answer to this question: chosen plaintext attack on CBC, predictable iv
(Only "Yes" and "No" are valid messages and the attacker knows this)
I am using 128-bit AES, CBC mode. Everything is in hex
Ciphertext: 030a 6eac 2641 e072 bd51 0d84 fb87 08da
I have encrypted the message like this:
printf "Yes" > yes
openssl enc -aes-128-cbc -e -in yes -out yes.aes -K 00112233445566778899aabbccddeeff -iv 12121212121212121212121212121212
The next IV (IV2) is going to be:
When an attacker knows this, it can calculate
IV1 XOR IV2 XOR "Yes"
and submit it to be encrypted with the next IV. If the ciphertexts match, then the attacker knows that the first message was in fact "Yes"
In my example the XOR calculation results to 59 65 72 which is in ASCII:
(calculated with http://xor.pw)
Now let's encrypt this and check if the ciphertexts match:
printf "Yer" > yer
openssl enc -aes-128-cbc -e -in yer -out yer.aes -K 00112233445566778899aabbccddeeff -iv 12121212121212121212121212121213
But now I get this as the ciphertext:
4378 8d70 de54 d287 8f64 1c8d ec40 de91
I was expecting it to be the same ciphertext as the one for the original "Yes"
I can't find my error. The attack should be correct, so I guess I am using OpenSSL incorrectly?