Editing Bit-flipping attack (section)

{{Short description|Cryptographic attack}}
A '''bit-flipping attack''' is an attack on a [[cryptography|cryptographic]] [[cipher]] in which the [[Adversary (cryptography)|attacker]] can change the [[ciphertext]] in such a way as to result in a predictable change of the [[plaintext]], although the attacker is not able to learn the plaintext itself. Note that this type of attack is not—directly—against the cipher itself (as [[cryptanalysis]] of it would be), but against a particular message or series of messages. In the extreme, this could become a [[Denial of service attack]] against all messages on a particular channel using that cipher.<ref>{{cite web|title=7019 - AES Bit-Flipping Attack|url=https://www.hacking-lab.com/cases/7019-aes-bit-flipping-attack/index.html|publisher=Hacking-Lab|accessdate=4 November 2013}}</ref>

The attack is especially dangerous when the attacker knows the format of the message. In such a situation, the attacker can turn it into a similar message but one in which some important information is altered. For example, a change in the destination address might alter the message route in a way that will force re-encryption with a weaker cipher, thus possibly making it easier for an attacker to decipher the message.<ref>{{Cite web|title=Bit-flipping Attack|url=https://eprint.iacr.org/2017/1170.pdf|url-status=live|archive-url=https://web.archive.org/web/20211108072737/https://eprint.iacr.org/2017/1170.pdf |archive-date=2021-11-08 }}</ref>

When applied to [[digital signature]]s, the attacker might be able to change a [[promissory note]] stating "I owe you $10.00" into one stating "I owe you $10,000".<ref>Kimberly Graves, ''Certified Ethical Hacker Study Guide'', Sybex 2010, page 6</ref>

[[Stream cipher]]s, such as [[RC4 (cipher)|RC4]], are vulnerable to a bit-flipping attack, as are some [[block cipher]] modes of operation.  ''See'' [[stream cipher attack]]. A keyed [[message authentication code]], [[digital signature]], or other authentication mechanism allows the recipient to detect if any bits were flipped in transit.<ref>{{Cite book|last1=JungWoon Lee|last2=DongYeop Hwang|last3=JiHong Park|last4=Ki-Hyung Kim|title=2017 International Conference on Information Networking (ICOIN) |chapter=Risk analysis and countermeasure for bit-flipping attack in LoRaWAN |chapter-url=https://ieeexplore.ieee.org/document/7899554|year=2017 |pages=549–551|doi=10.1109/ICOIN.2017.7899554|isbn=978-1-5090-5124-3 |s2cid=8575284 }}</ref>