AES CBC Bit-Flipping

Updated 13 Sep 2026

•
What it is
- •
  An attack on CBC decryption where flipping bits in one ciphertext block predictably flips the same bits in the next decrypted plaintext block, because $P_i = D_K(C_i) \oplus C_{i-1}$ . Controlling the IV (or a preceding block) lets an attacker rewrite arbitrary bytes of the following plaintext block without knowing the key.
•
When to apply
- •
  An application decrypts attacker-supplied ciphertext and IV under CBC, then trusts fields parsed out of the resulting plaintext (e.g. admin=False in a cookie) with no integrity check (no MAC/signature).
•
Math
- •
  $\text{delta} = P_{\text{actual}} \oplus P_{\text{target}}$ ; $\quad IV_{\text{new}} = IV \oplus \text{delta}$ (applied at the byte offsets you want to change).
•
Worked example
- •
  Cookie user=guest_perm0, encrypted under an all-zero IV. Computing delta = xor("user=guest_perm0", "user=admin_perm0") and XORing it into the IV, then decrypting the original ciphertext with the new IV, yields the plaintext user=admin_perm0 exactly — the key was never touched or needed.

Python

delta = xor(b"admin=False", b"admin=True;")
new_iv = xor(iv[:len(delta)], delta) + iv[len(delta):]