What is the fundamental interface security problem, and how do attackers exploit it?

Question

Accepted Answer

The whole class of injection attacks is one inequality: Dec(Enc(M)) ≠ M — the receiver decodes the data into something the sender never meant, and the attacker engineers that difference on purpose.
When the round-trip is faithful (Dec(Enc(M)) = M) the interface is safe; the moment it breaks, the attacker's data acquires a second meaning on the far side:
The problem:
Sender intends M → Enc(M) → Channel → Dec(Enc(M)) → Receiver gets M' ≠ M

How attackers exploit this — all 4 conditions must hold:

Condition
Meaning
SQL injection example

M ≠ Dec(Enc(M))
Input transforms into something different
O'Brien becomes SQL code break

M is valid for sender
Input passes client-side checks
Name field accepts apostrophes

Dec(Enc(M)) is valid for receiver
Result is executable
Database parses it as valid SQL

Actions differ
Sender expects data storage, receiver executes code
INSERT becomes INSERT + DROP TABLE

Why this matters: SQL injection, XSS, command injection, and URL encoding attacks ALL exploit this same pattern — data that means one thing to the sender means something different to the receiver.

Condition	Meaning	SQL injection example
M ≠ Dec(Enc(M))	Input transforms into something different	`O'Brien` becomes SQL code break
M is valid for sender	Input passes client-side checks	Name field accepts apostrophes
Dec(Enc(M)) is valid for receiver	Result is executable	Database parses it as valid SQL
Actions differ	Sender expects data storage, receiver executes code	`INSERT` becomes `INSERT + DROP TABLE`