Malleability for varying length message Given ciphertext for a message encrypted using $AES-CTR$ along with actual, desired message and IV, I need to perform malleability attack on the ciphertext to change the original message from $M$ to $M'$. But the message length of $M$ and $M'$ isn't the same. Since CTR doesn't use padding and the ciphertext is same length as the message then should I remove the extra bytes from ciphertext in the forged cipher to get $M'$ as its shorter than $M$?
To explain this better please see the following example of what I have done so far!
$M$ = &quot;Pay alex \$100&quot;
$M'$ = &quot;Pay \$900&quot;
$C$ = Ciphertext with first block as IV

Calculate $x = M ⊕ M'$ (I padded $M'$ before XOR to match length of $M$)
$C' = C[17... n]$ (Exclude initial 16 bytes as it corresponds to IV)
$C'' = C' ⊕ x$
Forged Cipher $C^* = C[1.. 16]||C''$ (First 16 bytes is the IV)

When I decrypt the forged ciphertext $C^*$ I get the expected message but with extra characters in the end as &quot;Pay $900.....&quot;.
So in the forged cipher-text if I remove the last 10 hex characters I get the exact message $M'$ that I was expecting. Is it right approach to get rid of the extra bits in the forged cipher-text to match the message length or what I've done is incorrect?
Yes, you got it right. You XOR'ed the correct bits, copied the IV and then shortened the message. Nothing wrong with that approach.
The only thing that I'm a bit critical about is the one based indexing instead of the zero based indexing. Most mathematicians use zero based indexing (because it is compatible with modular calculations, for instance) and similarly do most developers and therefore cryptographers...