Given ciphertext for a message encrypted using $AES-CTR$ along with actual, desired message and IV, I need to perform malleability attack on the ciphertext to change the original message from $M$ to $M'$. But the message length of $M$ and $M'$ isn't the same. Since CTR doesn't use padding and the ciphertext is same length as the message then should I remove the extra bytes from ciphertext in the forged cipher to get $M'$ as its shorter than $M$?

To explain this better please see the following example of what I have done so far!

$M$ = "Pay alex \$100"
$M'$ = "Pay \$900"
$C$ = Ciphertext with first block as IV

  • Calculate $x = M ⊕ M'$ (I padded $M'$ before XOR to match length of $M$)
  • $C' = C[17... n]$ (Exclude initial 16 bytes as it corresponds to IV)
  • $C'' = C' ⊕ x$
  • Forged Cipher $C^* = C[1.. 16]||C''$ (First 16 bytes is the IV)

When I decrypt the forged ciphertext $C^*$ I get the expected message but with extra characters in the end as "Pay $900.....".

So in the forged cipher-text if I remove the last 10 hex characters I get the exact message $M'$ that I was expecting. Is it right approach to get rid of the extra bits in the forged cipher-text to match the message length or what I've done is incorrect?


Yes, you got it right. You XOR'ed the correct bits, copied the IV and then shortened the message. Nothing wrong with that approach.

The only thing that I'm a bit critical about is the one based indexing instead of the zero based indexing. Most mathematicians use zero based indexing (because it is compatible with modular calculations, for instance) and similarly do most developers and therefore cryptographers...

  • 2
    $\begingroup$ A small improvement, the protocol may be transmitting the length, instead of trimming one can convert these values to space char. $\endgroup$ – kelalaka Nov 8 '20 at 15:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.