Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Lets say that I have a server which encrypts information at the server side using ECB mode with the blocksize of 16. If the server appends data that I control with a secret and sends back the ciphertext, it is possible for me to figure out what the secret is, by bruteforcing one character at a time.

Now lets consider a scenario where there is some secret data(say A) being prepended to my data(whose length I'm unaware of). There is also some some other secret data(say B, whose length I'm also unaware of) appended to my data. This is then encrypted and sent back over to me. Is there any way I can figure out what "B" is?

share|improve this question
up vote 4 down vote accepted

Yes, this is easy enough to exploit.

Start by sending any 15-byte message $m$, and then 256 different 16-byte messages consisting of $m$ followed by each of the 256 possible values of the last byte.

One of the encrypted 16-byte messages will have the same first ciphertext block as the encryption of $m$. Find out which, and you've found the first byte of the secret!

Now, can you figure out how to repeat this to find the second byte of the secret, and so on?

For the second task, start by figuring out the length of the secret prefix. How would you do that? (Hint: Try changing the first byte of your message and seeing which ciphertext block changes. What does this tell you? How would you figure out the length of the prefix more precisely?)

share|improve this answer
I'm not sure I get you -- I dont know the length of A, and I dont know how many bytes of my my input are required before I can get a new block. The plaintext whose cipher is calculated is (<A> + <my data> + <B>) – eQuiNoX__ Dec 21 '13 at 12:14
(and I'm unaware of the length of both "A" and "B") – eQuiNoX__ Dec 21 '13 at 12:15
You should be able to find out the length of A, at least rounded down to a multiple of 16 bytes, by changing your message and seeing which ciphertext block is the first one that changes. Can you then figure out how to get the exact length of A in bytes? (Hint: What happens to the ciphertext if A is, say, 15 bytes long, and you change the first byte of your data? What if you change the second byte instead?) – Ilmari Karonen Dec 21 '13 at 15:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.