Exercise 3: Bit-Flipping a CTR-Mode Bank Transfer — Possible Solution
====================================================================

How the attack works against plain CTR mode:

Per the chapter's CTR formula, Ciphertext = Plaintext XOR Keystream.
This means an attacker doesn't need to know the keystream's VALUE to
change the plaintext -- they only need to know WHERE in the ciphertext
the amount field lives (stated in the exercise as a known byte
position) and flip specific bits directly in the ciphertext at that
position.

Flipping a bit in the ciphertext at a given position flips the
CORRESPONDING bit in the decrypted plaintext at that exact position,
because XOR is its own inverse: whatever change is made to the
ciphertext bit propagates directly and predictably into the decrypted
plaintext bit, with no need to know the actual keystream value at all.
An attacker who understands roughly how the amount is encoded (for
example, flipping specific bits of a binary-encoded number to increase
it) can make a controlled, predictable change to the transferred
amount -- all without ever decrypting a single byte of the message or
knowing the key.

Because plain CTR mode is confidentiality-only (per this chapter's
"Missing Piece" section), there is nothing in CTR mode itself that
would detect this tampering. The receiving system decrypts the
ciphertext, gets a plaintext with an altered amount, and has no signal
that anything was changed in transit.

Why switching to GCM prevents this:

GCM adds an authentication tag (via GMAC) computed over the entire
ciphertext at encryption time. Any bit flipped in the ciphertext after
that tag was generated -- including the bit-flipping attack described
above -- changes what the correct tag SHOULD be, but the attacker has
no way to recompute a matching tag without the key. When the receiving
system verifies the tag during decryption and finds it doesn't match,
it rejects the message outright rather than accepting a tampered
plaintext. The tampering isn't just detected after the fact -- GCM
implementations are specifically designed to refuse to output any
plaintext at all if the tag check fails.

WHY THIS WORKS AS AN ANSWER
------------------------------
This makes concrete exactly what the chapter's "Missing Piece" section
described abstractly ("an attacker... can flip specific bits without
ever needing the key, causing controlled, predictable changes in the
decrypted plaintext") and then shows GCM (the chapter's own proposed
fix) closing that specific gap, using the same authentication-tag
mechanism the chapter names directly -- confirming that GCM's benefit
over plain CTR isn't hypothetical, it's this exact bit-flipping
scenario made impossible.