A side-channel attack on implementations of encryption modes that use padding (e.g. ECB, CBC) that uses information leaked during decryption of tampered ciphertext values to derive information about the plaintext.

learn more… | top users | synonyms

14
votes
2answers
6k views

Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme

Is it a weakness to use a single shared secret for protecting messages using a Encrypt-then-MAC scheme? Assuming a system is using AES-256-CBC and a SHA1-HMAC and the same secret key for both ...
3
votes
2answers
150 views

Why verify padding at all?

Whenever a ciphertext is decrypted using a block-cypher, we need to remove the padding. There are different ways to add padding, but they usually set the last byte of the last block to the number of ...
2
votes
1answer
2k views

Shortcuts / practicality of brute forcing block cipher (AES) + ECB with known plaintext

I know the plaintext (26 bytes long) and cryptotext of block cipher (suspected to be AES) in ECB mode. I can generate hundreds or thousands of such samples, but the samples are not arbitrary. What are ...
11
votes
2answers
8k views

How does a padding oracle attack work?

I am unsure of how a padding oracle attack works. What I am not getting is how changing one bit at one time allows one to exploit(get keys) ASP.NET machines. Can anyone explain this?