Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've written a script that breaks a cipher text based on a padding oracle for an assignment, but was wondering how I would continue on to create my own cipher text with any plain text I desired?

Someone on the class forum mentioned XORing the intermediate step (or the $D(C_i)$ before XOR with $C_{i-1}$) (taken from the process of breaking the original cipher text) with the plain text of my choice to generate $C_{i-1}$. I don't see how this works, or if I misunderstood what the poster was XORing together. I see how $D(C_i) \oplus C_{i-1} = P_i$, but not sure how you can use your own plain text in that way.

I'm looking for hints on how to approach this, or a clarification on the 2nd paragraph.

share|improve this question
    
It sounds to me like they are trying to combine a MITM attack and padding oracle. CBC is vulnerable to both, but I cannot imagine a scenario where combining the two makes sense. Padding oracle is to recover plain text without a key. MITM here is to forge cipher text without a key that decrypts to plain text of your choosing. It makes no more sense to me than trying to combine "frying an egg" and "jump starting a car". Different skills, different applications. Maybe I am just overlooking something, but to me combining them makes no sense. – WDS Oct 9 '15 at 1:30
    
The professor mentioned that it would require answering part 1 (breaking cipher with padding oracle) to answer part 2. I think I don't need to use the padding oracle directly perhaps, but it sounded like I needed something generated from solving part 1 to encrypt my own plaintext. – XeroAura Oct 9 '15 at 2:10
    
OK, yeah, I see now. I was being dense. The MITM attack requires you know or correctly guess the plain text of the block you wish to alter. So OK, you use padding oracle to discover what that plain text is, then use the correct XOR to change that to the output you want. – WDS Oct 9 '15 at 2:14

I've written a script that breaks a cipher text based on a padding oracle for an assignment, but was wondering how I would continue on to create my own cipher text with any plain text I desired?

You cannot. The padding oracle attack does not give you enough information to produce the ciphertext for any plaintext. You can do it for some plaintext, though.

Simplest example is any one block message. Since the padding oracle attack gives you pairs $y = E(x)$, you can calculate for (padded) one-block plaintext $p$ the ciphertext $(x \oplus p) || y$ using any such pair. (Here the first block is the IV.)

You can also modify any block of the original message(s) captured if you are willing to scramble the previous plaintext block. This is what the person in the class forum was talking about:

You decide to modify $P_i$ to $P_i'$. Since $P_i = D(c_i) \oplus c_{i-1}$ and you want $P_i' = D(c_i') \oplus c_{i-1}'$, it suffices to let $c_{i-1}' = c_{i-1} \oplus P_i \oplus P_i'$. That changes $P_{i-1}$ to some random value unless you happen to know what $D(c_{i-1}')$ is and can calculate the plaintext (and even modify it by scrambling $P_{i-2}$ in turn).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.