2
$\begingroup$

I'm currently practicing on a purposely flawed login page, where I have to change the value of a cookie to enter. The cookie is an encrypted and encoded form of a simple JSON string with fields "admin", "username", "password". The admin field is set to 0, and the user/pass fields accepts anything. To login, I have to change this ciphertext such that the admin field is set to 1 when decrypted.

The encryption function works like this:

  • A raw string is padded, then encrypted with AES-CBC and a random IV.
  • Then, this cipher text appends the IV (concatenation; IV+cipher).
  • Then, this is Base64 encoded, and returned.

So, to decrypt, we simply decode it with Base64, and split the result so that the 16 first characters are the IV, and the remaining is the ciphertext.

Now, I want to know the ciphertext when one character of the plaintext is changed.

Specifically, in my example:

The following string is encrypted, appended to the IV, and encoded:

{"admin": 0, "username": "admin", "password": "admin"}

This apparently results in the encoded text (found in cookie):

yMqlNejXMclgcU5+wbL40RY/mvIMW+AvguoMvCv0NemhRYzWzs7EQ2DXpvwsGmFynGpNWNyotYBea+P3Z3XZIvMBoMzdMVb/FtWQ+GV/MmA=

I'd like to know what this encoded text / cookie looks like if the plaintext is changed to {"admin": 1, "username": "admin", "password": "admin"} (note, the 0 changed to 1). The username and password can be anything, only the "admin": 1 part is important.

It appears the key is fixed, but the IV is generated at random every time I try to logout and login again.

Is this possible? If so, how?

Thanks!

Improve this question
$\endgroup$
4
  • 1
    $\begingroup$ Even without MAC authentication tag you couldn't change the ciphertext without rendering the token corrupt because AES-CBC isn't a stream cipher. $\endgroup$
    – DannyNiu
    Jan 25, 2019 at 6:14
  • 2
    $\begingroup$ Hint: how is the IV used during decryption? Check the cipher modes of operation page on Wikipedia. $\endgroup$
    – Maarten Bodewes ♦
    Jan 25, 2019 at 6:31
  • $\begingroup$ You might also look at Bit Flipping Attack on CBC Mode $\endgroup$
    – kelalaka
    Jan 26, 2019 at 13:48
  • 1
    $\begingroup$ @kelalaka Thanks! That was exactly what I was thinking of, but for some reason it didn't "click in" until you wrote it out loud. Solved the problem by decoding the Base64 to hex, flip the bit in question, and re-encode it to Base64. Worked like a charm. :-) $\endgroup$
    – sp4rr0w
    Jan 27, 2019 at 0:52

1 Answer 1

Reset to default
2
$\begingroup$

This question is educationally illustrative and deserves a good answer.

Because in CBC, $C_i = E_k(C_{i-1} \oplus P_i)$, and $C_0 = IV$, you can alter any bit in the first block by changing $IV$ without affecting later blocks and won't get caught because there isn't a MAC tag.

Take a look at this graph: 

0123456789abcdef // numbering
{"admin": 0, "us // json token
ivivivivivIviviv // init vec
~~~~~~~~~~^~~~~~ // change

This shows once again why message authentication is important, and symmetric-key encryption should follow AEAD paradigm.

Improve this answer
$\endgroup$
0

Not the answer you're looking for? Browse other questions tagged or ask your own question.