Is the Bit Flipping attack on CBC mode possible if the IV is not know to the attacker?

Question

This is a follow up question to: Bit Flipping Attack on CBC Mode

which demonstrates that a bit flipping attack with a known IV is possible on CBC mode.

Is it safe to assume that the bit flicking attack is not possible if the attacker doesn't know the IV?

score 1 · Accepted Answer · answered Nov 02 '23 at 15:21

1

You would not be able to flip just a single bit as changing the previous ciphertext block will result in a randomized plaintext at that position.

However, as indicated in the other answer it is certainly possible to change block + a bit.

Furthermore, other attacks such as padding oracle attacks would probably still work.

answered Nov 02 '23 at 15:21

Maarten Bodewes

It took me a while to understand your response :) IMHO the green case in the other post is the most dangerous. Seeing randomized data in the red case plaintext will probably alert the receiver. According to the NIST recommendations, IV does not need to be secret. Is this a good case to claim otherwise? – Nov 04 '23 at 17:44
"Seeing randomized data in the red case plaintext will probably alert the receiver." Alert who? Usually ciphertext isn't processed by a human but by some kind of automated process. And note that the plaintext may represent any kind of data, such as imagery etc. NIST doesn't recommend encrypting the IV because CBC mode is not meant to provide any message integrity or authenticity. So that argument is moot. – Maarten Bodewes Nov 04 '23 at 18:19
Neither is the most dangerous as long as you authenticate your ciphertext. This is why we use AEAD ciphers such as GCM-mode at the moment. Otherwise you can use HMAC over the ciphertext as long as you include the IV in the calculations. And if you're hell bound on using CBC then EAX or CCM mode would be candidates as even the CBC-MAC and CMAC calculations that they use are based on that mode. – Maarten Bodewes Nov 04 '23 at 18:19

1 Answers1