# Malleability for varying length message

Given ciphertext for a message encrypted using $$AES-CTR$$ along with actual, desired message and IV, I need to perform malleability attack on the ciphertext to change the original message from $$M$$ to $$M'$$. But the message length of $$M$$ and $$M'$$ isn't the same. Since CTR doesn't use padding and the ciphertext is same length as the message then should I remove the extra bytes from ciphertext in the forged cipher to get $$M'$$ as its shorter than $$M$$?

To explain this better please see the following example of what I have done so far!

$$M$$ = "Pay alex \$100" $$M'$$ = "Pay \$900"
$$C$$ = Ciphertext with first block as IV

• Calculate $$x = M ⊕ M'$$ (I padded $$M'$$ before XOR to match length of $$M$$)
• $$C' = C[17... n]$$ (Exclude initial 16 bytes as it corresponds to IV)
• $$C'' = C' ⊕ x$$
• Forged Cipher $$C^* = C[1.. 16]||C''$$ (First 16 bytes is the IV)

When I decrypt the forged ciphertext $$C^*$$ I get the expected message but with extra characters in the end as "Pay \$900.....".

So in the forged cipher-text if I remove the last 10 hex characters I get the exact message $$M'$$ that I was expecting. Is it right approach to get rid of the extra bits in the forged cipher-text to match the message length or what I've done is incorrect?