Given ciphertext for a message encrypted using $AES-CTR$ along with actual, desired message and IV, I need to perform malleability attack on the ciphertext to change the original message from $M$ to $M'$. But the message length of $M$ and $M'$ isn't the same. Since CTR doesn't use padding and the ciphertext is same length as the message then should I remove the extra bytes from ciphertext in the forged cipher to get $M'$ as its shorter than $M$?
To explain this better please see the following example of what I have done so far!
$M$ = "Pay alex \$100"
$M'$ = "Pay \$900"
$C$ = Ciphertext with first block as IV
- Calculate $x = M ⊕ M'$ (I padded $M'$ before XOR to match length of $M$)
- $C' = C[17... n]$ (Exclude initial 16 bytes as it corresponds to IV)
- $C'' = C' ⊕ x$
- Forged Cipher $C^* = C[1.. 16]||C''$ (First 16 bytes is the IV)
When I decrypt the forged ciphertext $C^*$ I get the expected message but with extra characters in the end as "Pay $900.....".
So in the forged cipher-text if I remove the last 10 hex characters I get the exact message $M'$ that I was expecting. Is it right approach to get rid of the extra bits in the forged cipher-text to match the message length or what I've done is incorrect?