# Creating own ciphertext after a padding oracle attack?

I've written a script that breaks a cipher text based on a padding oracle for an assignment, but was wondering how I would continue on to create my own cipher text with any plain text I desired?

Someone on the class forum mentioned XORing the intermediate step (or the $D(C_i)$ before XOR with $C_{i-1}$) (taken from the process of breaking the original cipher text) with the plain text of my choice to generate $C_{i-1}$. I don't see how this works, or if I misunderstood what the poster was XORing together. I see how $D(C_i) \oplus C_{i-1} = P_i$, but not sure how you can use your own plain text in that way.

I'm looking for hints on how to approach this, or a clarification on the 2nd paragraph.

-
It sounds to me like they are trying to combine a MITM attack and padding oracle. CBC is vulnerable to both, but I cannot imagine a scenario where combining the two makes sense. Padding oracle is to recover plain text without a key. MITM here is to forge cipher text without a key that decrypts to plain text of your choosing. It makes no more sense to me than trying to combine "frying an egg" and "jump starting a car". Different skills, different applications. Maybe I am just overlooking something, but to me combining them makes no sense. – WDS Oct 9 '15 at 1:30
The professor mentioned that it would require answering part 1 (breaking cipher with padding oracle) to answer part 2. I think I don't need to use the padding oracle directly perhaps, but it sounded like I needed something generated from solving part 1 to encrypt my own plaintext. – XeroAura Oct 9 '15 at 2:10
OK, yeah, I see now. I was being dense. The MITM attack requires you know or correctly guess the plain text of the block you wish to alter. So OK, you use padding oracle to discover what that plain text is, then use the correct XOR to change that to the output you want. – WDS Oct 9 '15 at 2:14

Simplest example is any one block message. Since the padding oracle attack gives you pairs $y = E(x)$, you can calculate for (padded) one-block plaintext $p$ the ciphertext $(x \oplus p) || y$ using any such pair. (Here the first block is the IV.)
You decide to modify $P_i$ to $P_i'$. Since $P_i = D(c_i) \oplus c_{i-1}$ and you want $P_i' = D(c_i') \oplus c_{i-1}'$, it suffices to let $c_{i-1}' = c_{i-1} \oplus P_i \oplus P_i'$. That changes $P_{i-1}$ to some random value unless you happen to know what $D(c_{i-1}')$ is and can calculate the plaintext (and even modify it by scrambling $P_{i-2}$ in turn).