An attack on CBC-mode encryption where modifying ciphertext bytes causes predictable changes in the next decrypted block, enabling content manipulation.
CBC Bit Flipping Attack exploits the chaining property of CBC mode encryption. By flipping bits in one ciphertext block, an attacker can make predictable changes to the next decrypted plaintext block, potentially modifying data like user roles or amounts.
Encryption:
C[i] = Encrypt(P[i] XOR C[i-1])
Decryption:
P[i] = Decrypt(C[i]) XOR C[i-1]
// Key insight: modifying C[i-1] affects P[i]// If we know the plaintext P[i] at some position:
// And we want it to become P'[i]:
// Modify C[i-1] by XORing with:
C'[i-1] = C[i-1] XOR P[i] XOR P'[i]
// Result after decryption:
P'[i] = Decrypt(C[i]) XOR C'[i-1]
= Decrypt(C[i]) XOR C[i-1] XOR P[i] XOR P'[i]
= P[i] XOR P[i] XOR P'[i]
= P'[i] ✓// Plaintext split into 16-byte AES blocks:
// P1 (bytes 0-15): "user=bob;xxxxxxx"
// P2 (bytes 16-31): "admin=0;tttttttt"
// Goal: turn "admin=0" into "admin=1".
// The target is the '0' byte at offset 6 within P2.
// Flipping a byte in ciphertext block C1 flips the
// same-position byte of plaintext block P2, while
// CORRUPTING all of block P1 (it decrypts to garbage).
// XOR mask for the '0' -> '1' change (a single bit):
// '0' XOR '1' = 0x30 XOR 0x31 = 0x01
// Apply the mask to the byte at offset 6 of C1.
// After decryption, P2 now reads "admin=1;..."The block you modify (C[i-1]) decrypts to garbage. Attackers must ensure this doesn't break parsing or is in a non-critical field.