Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Assuming, I had a ciphertext along with its decrypted plain text result but not the IV or the Secret Key. (keep in mind that the text was encrypted with AES/CBC/PKCSPadding7).
How would I go about changing specific characters in the ciphertext?
For Example:
Ciphertext: 08226C1C87A83DDF02C54CF0802624D8
Plaintext: Apple1
How would I change the ciphertext to decrypt to Apple2?
First, normally a message authentication function (e.g. HMAC) is used with AES-CBC, specifically to prevent the type of attack described in this question, where the ciphertext is altered by an attacker in an attempt to produce a ‘wanted plaintext’ upon decryption. See When do I need to use CBC and HMAC? for more info.
Also, the ciphertext that you posted is only one block long (16 bytes, or 128 bits). So, AES alone (without CBC, and therefore without an IV) could have been used to produce this one block ciphertext. It’s not clear from your question whether this one block of ciphertext was produced using AES alone, or using AES-CBC (with an IV).
If this one block of ciphertext as produced using AES-CBC (with an IV), then normally the IV would be sent along with the ciphertext. Without the IV, the recipient would have no way of decrypting the first block (and in this case, the only block) of the message. The HMAC (above) is usually taken over the ciphertext and the IV, so that an attacker cannot modify either of these without detection.
In light of the above, there are a few ways to answer this question.
Older encryption algorithms such as XOR, OTP, Caesar, etc. without authentication, are notorious for being vulnerable to the type of attack that you describe, where the ciphertext is altered to produce a ‘wanted plaintext’ (see examples at https://security.stackexchange.com/questions/33569/why-do-you-need-message-authentication-in-addition-to-encryption). However, putting aside the CBC part of AES-CBC, AES in and of itself is considered to be resilient to ‘known plaintext’ attacks. Therefore, knowing the ciphertext and the plaintext of the message does not give an attacker an advantage in finding the encryption key, or mounting an attack like the one that you describe.
If we consider AES with CBC (AES-CBC), and the ciphertext and IV are not authenticated using an HMAC as described above, and the attacker knows the original plaintext, then the attacker can change the IV to cause the decryption to produce any plaintext he wants in the first block (and in this case, the only block) of the message. See Can you change an AES encrypted message if you control the IV? for more info.
Nothing in this answer so far involves padding. The fact that you mention padding in your question suggests that perhaps you are thinking of a padding oracle attack. This type of attack requires the recipient of the message to leak information when it encounters a padding error upon decrypting the message. In this case, the attacker can gradually deduce the encryption key by repeatedly crafting and submitting ciphertexts to the recipient for decryption, and learning from the recipient which ones produce padding errors. Once the attacker learns the encryption key, he simply uses it to encrypt the wanted plaintext, so that upon decryption, the ciphertext decrypts to the wanted plaintext.
