The Controlled Change

Unauthenticated Honesty Boundary

The toy shows malleability when no authentication check rejects the edit.

highlighted = computed this step

The receiver decrypts the changed bytes

With the same keystream, the modified ciphertext decrypts to the target plaintext. There is no authentication tag in this toy to reject the edit.

decrypted modified=0x7061793d3930\text{decrypted modified}=0x7061793d3930
Unauthenticated changeThe target, attack mask, modified ciphertext, and decrypted result are recomputed.Target plaintext48 bits / 6 bytes0x7061793d3930byte 0byte 1byte 2byte 301110000011000010111100100111101byte 4byte 50011100100110000byte-00x70byte-10x61byte-20x79byte-30x3dbyte-40x39byte-50x30Attack mask48 bits / 6 bytes0x000000000800byte 0byte 1byte 2byte 300000000000000000000000000000000byte 4byte 50000100000000000byte-00x00byte-10x00byte-20x00byte-30x00byte-40x08byte-50x00Modified ciphertext48 bits / 6 bytes0x7f7f5401726abyte 0byte 1byte 2byte 301111111011111110101010000000001byte 4byte 50111001001101010byte-00x7fbyte-10x7fbyte-20x54byte-30x01byte-40x72byte-50x6aDecrypted modified48 bits / 6 bytes0x7061793d3930byte 0byte 1byte 2byte 301110000011000010111100100111101byte 4byte 50011100100110000byte-00x70byte-10x61byte-20x79byte-30x3dbyte-40x39byte-50x30Toy bit flip rows - changed byte 4rowvaluecheckplaintext7061793d3130pinned byteskeystream0f1e2d3c4b5apinned bytesciphertext7f7f54017a6aplaintext xor keystreamtarget plaintext7061793d3930attacker targetattack mask000000000800plaintext xor targetmodified ciphertext7f7f5401726aciphertext xor maskdecrypted modified7061793d3930modified ciphertext xor keystream

The controlled result

The decrypted modified plaintext is 0x7061793d3930, which says pay equals 90.

pay=90\text{pay}=90
Unauthenticated changeThe target, attack mask, modified ciphertext, and decrypted result are recomputed.Target plaintext48 bits / 6 bytes0x7061793d3930byte 0byte 1byte 2byte 301110000011000010111100100111101byte 4byte 50011100100110000byte-00x70byte-10x61byte-20x79byte-30x3dbyte-40x39byte-50x30Attack mask48 bits / 6 bytes0x000000000800byte 0byte 1byte 2byte 300000000000000000000000000000000byte 4byte 50000100000000000byte-00x00byte-10x00byte-20x00byte-30x00byte-40x08byte-50x00Modified ciphertext48 bits / 6 bytes0x7f7f5401726abyte 0byte 1byte 2byte 301111111011111110101010000000001byte 4byte 50111001001101010byte-00x7fbyte-10x7fbyte-20x54byte-30x01byte-40x72byte-50x6aDecrypted modified48 bits / 6 bytes0x7061793d3930byte 0byte 1byte 2byte 301110000011000010111100100111101byte 4byte 50011100100110000byte-00x70byte-10x61byte-20x79byte-30x3dbyte-40x39byte-50x30Toy bit flip rows - changed byte 4rowvaluecheckplaintext7061793d3130pinned byteskeystream0f1e2d3c4b5apinned bytesciphertext7f7f54017a6aplaintext xor keystreamtarget plaintext7061793d3930attacker targetattack mask000000000800plaintext xor targetmodified ciphertext7f7f5401726aciphertext xor maskdecrypted modified7061793d3930modified ciphertext xor keystream

What this does not claim

NOTE: toy unauthenticated XOR-mode illustration only; not AES internals, not nonce management, not a complete authenticated-encryption construction, and not production exploit guidance.

toy only=1\text{toy only}=1
Unauthenticated changeThe target, attack mask, modified ciphertext, and decrypted result are recomputed.Target plaintext48 bits / 6 bytes0x7061793d3930byte 0byte 1byte 2byte 301110000011000010111100100111101byte 4byte 50011100100110000byte-00x70byte-10x61byte-20x79byte-30x3dbyte-40x39byte-50x30Attack mask48 bits / 6 bytes0x000000000800byte 0byte 1byte 2byte 300000000000000000000000000000000byte 4byte 50000100000000000byte-00x00byte-10x00byte-20x00byte-30x00byte-40x08byte-50x00Modified ciphertext48 bits / 6 bytes0x7f7f5401726abyte 0byte 1byte 2byte 301111111011111110101010000000001byte 4byte 50111001001101010byte-00x7fbyte-10x7fbyte-20x54byte-30x01byte-40x72byte-50x6aDecrypted modified48 bits / 6 bytes0x7061793d3930byte 0byte 1byte 2byte 301110000011000010111100100111101byte 4byte 50011100100110000byte-00x70byte-10x61byte-20x79byte-30x3dbyte-40x39byte-50x30Toy bit flip rows - changed byte 4rowvaluecheckplaintext7061793d3130pinned byteskeystream0f1e2d3c4b5apinned bytesciphertext7f7f54017a6aplaintext xor keystreamtarget plaintext7061793d3930attacker targetattack mask000000000800plaintext xor targetmodified ciphertext7f7f5401726aciphertext xor maskdecrypted modified7061793d3930modified ciphertext xor keystream

Summary

Without authentication, a controlled ciphertext change can control a plaintext byte in XOR-like modes.

authentication tag=0\text{authentication tag}=0
Unauthenticated changeThe target, attack mask, modified ciphertext, and decrypted result are recomputed.Target plaintext48 bits / 6 bytes0x7061793d3930byte 0byte 1byte 2byte 301110000011000010111100100111101byte 4byte 50011100100110000byte-00x70byte-10x61byte-20x79byte-30x3dbyte-40x39byte-50x30Attack mask48 bits / 6 bytes0x000000000800byte 0byte 1byte 2byte 300000000000000000000000000000000byte 4byte 50000100000000000byte-00x00byte-10x00byte-20x00byte-30x00byte-40x08byte-50x00Modified ciphertext48 bits / 6 bytes0x7f7f5401726abyte 0byte 1byte 2byte 301111111011111110101010000000001byte 4byte 50111001001101010byte-00x7fbyte-10x7fbyte-20x54byte-30x01byte-40x72byte-50x6aDecrypted modified48 bits / 6 bytes0x7061793d3930byte 0byte 1byte 2byte 301110000011000010111100100111101byte 4byte 50011100100110000byte-00x70byte-10x61byte-20x79byte-30x3dbyte-40x39byte-50x30Toy bit flip rows - changed byte 4rowvaluecheckplaintext7061793d3130pinned byteskeystream0f1e2d3c4b5apinned bytesciphertext7f7f54017a6aplaintext xor keystreamtarget plaintext7061793d3930attacker targetattack mask000000000800plaintext xor targetmodified ciphertext7f7f5401726aciphertext xor maskdecrypted modified7061793d3930modified ciphertext xor keystream