Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So after some searching, I kinda know the attack procedure of altering bit by bit. But I'm still confused how this is possible. If I understand it correctly, the attacker never has the key, or tries to iterate keys. So since the oracle can check the padding, I guess itself has the encryption key?

What is a real life oracle example I can see? I know this should be well patched nowadays, but what were affected before patching? I read that some kinds of web servers were impacted most, but what part of the server has this kind of oracle?

share|improve this question
Usually, such vulnerabilities are in the SSL/TLS part, since in most cases, the only $\hspace{1.45 in}$ other cryptography they do is password hashing. $\;$ – Ricky Demer Oct 12 '15 at 14:27
up vote 2 down vote accepted

There are many examples of real padding-oracle attacks in practice. SSL/TLS is arguably the most famous example. However, they appear everywhere. In a paper by Practical Padding Oracle Attacks by Rizzo and Duong they find a number of interesting examples. But, they are really all over the place.

share|improve this answer

In cryptography Oracle models a party in a given protocol that can answer to some precise questions. It is called Oracle because as the mythological Oracles, we don't know how they get the answer. This bit is very important in proven security as it allows to model a generic attacker and prove a protocol correctness against many possibles attackers.

In real life, an Oracle is usually given by a server that knows the secret key (or any other secret data) and can compute some function on the challenge ciphertext. The way the Oracle conveys the answer could vary: an direct message, an error message, a crash, ...

The typical school case is a TLS server, it knows the secret key and gives different errors message depending on padding, integrity, ... An other example could be a license checking routine: different error messages if the file is bad formatted or badly signed or ... An (unlikely) example could be your friend telling you "Yo, the PGP encrypted mail you sent me, gave me an error padding, could you send it one more time?"

share|improve this answer

You could look up the POODLE attack on SSL3 (pdf). It affected several implementations, but apparently e.g. OpenSSL 1.0.1i and earlier were affected.

The idea is that an attacker can send modifier ciphertext for decryption (by a server which does know the key) and observe whether that results in correct padding. The pdf linked above outlines how it can be used in a browser context:

In the web setting, this SSL 3.0 weakness can be exploited by a man­-in-the-middle attacker to decrypt “secure” HTTP cookies, using techniques from the BEAST attack [BEAST]. To launch the POODLE attack (Padding Oracle On Downgraded Legacy Encryption), run a JavaScript agent on (or on to get the victim’s browser to send cookie­-bearing HTTPS requests to, and intercept and modify the SSL records sent by the browser in such a way that there’s a non­-negligible chance that will accept the modified record. If the modified record is accepted, the attacker can decrypt one byte of the cookies.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.