# AES-CBC decrypts to wrong output?

Someone I know showed this to me, and I can't put a finger to why it's happening. Am I missing something?

They encrypt the text, and the output is really guessable. $$u\to t$$, $$i\to h$$ (it's one letter behind), the $$?$$ are just spaces. • Could you tell me the name of the software that is shown above? – Patriot Feb 20 at 0:47
• This is GCHQ's CyberChef. – Mark Feb 20 at 3:01
• For the sake of future references, could you write the encryption key completely? – kelalaka Feb 20 at 7:18

## 2 Answers

They trick you with the IV. The IV must be the same for encryption and decryption so that the encryption has the functionality that is;

$$m = D_k(IV,E_k(IV,m))$$ To surprise you, they modify the IV according to their desire but you failed to see that. This is the more general case of the Bit-Flipping attack on the CBC mode.

This attack works because the message has only one block and the change on the IV only modifies the first block. Nothing special there.

Pick a key $$K$$. Pick a one-block message $$m$$ and the desired ciphertext $$c$$. Then compute the IV for CBC as follows:

$$c=E_K(IV\oplus m)\iff D_K(c)\oplus m=IV$$

where $$E_K$$ is AES encryption under the key $$K$$ and $$D_K$$ is the corresponding decryption and $$\oplus$$ is bitwise XOR.

Now you have the IV that maps $$m$$ to $$c$$ under the key $$K$$ with all three of them being freely choosable.