A side-channel attack on implementations of encryption modes that use padding (e.g. ECB, CBC) that uses information leaked during decryption of tampered ciphertext values to derive information about the plaintext.

learn more… | top users | synonyms

14
votes
2answers
6k views

Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme

Is it a weakness to use a single shared secret for protecting messages using a Encrypt-then-MAC scheme? Assuming a system is using AES-256-CBC and a SHA1-HMAC and the same secret key for both ...
11
votes
2answers
8k views

How does a padding oracle attack work?

I am unsure of how a padding oracle attack works. What I am not getting is how changing one bit at one time allows one to exploit(get keys) ASP.NET machines. Can anyone explain this?
11
votes
1answer
2k views

Bleichenbacher 1998 “Million message attack” on RSA

I have been reading Bleichenbacher's 1998 paper on a forged message attack on RSA. The paper assumes access to an Oracle that takes a ciphertext $c$ and will check the decrypted text for valid PKCS #1 ...
8
votes
3answers
1k views

Modes of operation that allow padding oracle attacks

It seems to me that padding oracle attacks are mainly a concern for users of CBC mode encryption. Question: are any other modes of operation vulnerable to padding oracle attacks? And if so, why? ...
5
votes
2answers
776 views

How to verify the integrity of RSA encrypted messages?

I need to encrypt messages using PublicKeyCrypto and send it to the server, where the message should be decrypted. I'm aware of the Padding Oracle Attack and want to apply a server side integrity ...
4
votes
2answers
153 views

Why verify padding at all?

Whenever a ciphertext is decrypted using a block-cypher, we need to remove the padding. There are different ways to add padding, but they usually set the last byte of the last block to the number of ...
4
votes
1answer
81 views

Creating own ciphertext after a padding oracle attack?

I've written a script that breaks a cipher text based on a padding oracle for an assignment, but was wondering how I would continue on to create my own cipher text with any plain text I desired? ...
3
votes
1answer
290 views

How to use HMAC for large ciphertexts over TLS

HMAC used to secure chosen cipher-text attacks. if we are encrypting a large file (video) and sending it over TLS for decryption, how server can check MAC for ciphertext when we didn't sent whole of ...
3
votes
1answer
1k views

Extract private RSA key from USB cryptographic token using Bardou et al. attack (variant of “million message attack”)

There is a side channel attack on tamper-resistant USB cryptographic tokens using padding-oracle, described by Bardou, Focardi, Kawamoto, Simionato, Steel and Tsay, titled "Efficient padding oracle ...
3
votes
1answer
158 views

Is RSA vulnerable to the padding oracle attack?

I know that AES in combination with CBC mode is vulnerable against the Padding Oracle Attack. RSA also uses some kind of padding, hence can this attack be apply to RSA encrypted messages too?
3
votes
1answer
114 views

How to make PKCS conformation oracle for trying Bleichenbacher’s RSA attack?

I was trying to understand Bleichenbacher’s CCA attack and thought of work it out in python. Can some one throw some light on the the logic behind the oracle used to check PKCS conformation? Will a ...
3
votes
1answer
63 views

How does padding oracle attack work with bytes larger than possible length?

I am trying to understand how the POODLE attack would actually be implemented. In the original security advisory from Möller, Duong and Kotowicz [POODLE 14] the following example is presented: ...
2
votes
2answers
63 views

Is this approach able to protect against padding oracle attacks?

I know that a protection against the padding oracle attack is to encrypt-then-mac. This is to avoid trying to decrypt a modified ciphertext, and leak information about padding errors. Suppose that we ...
2
votes
3answers
135 views

Why not put MAC in fixed position and cover padding for MAC-then-encrypt?

The biggest problem with using MtE with a mode where it's known to be secure (CBC) is with the padding, where you can't retrieve the authentication until you know where it is by looking at the padding ...
2
votes
1answer
2k views

Shortcuts / practicality of brute forcing block cipher (AES) + ECB with known plaintext

I know the plaintext (26 bytes long) and cryptotext of block cipher (suspected to be AES) in ECB mode. I can generate hundreds or thousands of such samples, but the samples are not arbitrary. What are ...
2
votes
1answer
480 views

Is it safe to use GZIP to avoid padding related attacks

I am designing a library that supports encrypting some in-memory data using AES in CBC mode. Now I need a padding but it seemed to me that Apple's CommonCrypto library and OpenSSL have different ...
2
votes
1answer
159 views

Bit padding instead of PKCS#5 padding

Padding oracle attacks are a huge nuisance when using CBC mode encryption without authentication. Wouldn't all those padding oracle attacks be avoided if we'd just use bit padding instead? Or is does ...
2
votes
0answers
224 views

Defending hybrid encryption schemes against padding oracle attacks

I intend to use a generic integrated/hybrid encryption scheme for transmitting information between a client and a server. Key encapsulation: a 128-bit symmetric key is generated and asymmetrically ...
1
vote
2answers
205 views

Why is this a fix to Bleichenbacher's attack?

Looking at the excellent explaination of the attack here: Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5? I have one additional question: It says that: ""To prevent this attack, SSL ...
1
vote
2answers
160 views

What is an easy method of proving that a cryptographic oracle attack is possible?

Lets say an application is using CBC mode without authentication. The application is generating cipher text. This cipher text can be manipulated by the attacker and then transmitted back to the ...
1
vote
1answer
197 views

Security of (cryptographic) padding compared to other methods for blockcompletion for block ciphers

As said in the heading, I want to know how the security of different padding methods, e.g. ANSI X.923, ISO 10126 and PKCS7, is compared to other methods to reach the needed block size, like ciphertext ...
1
vote
1answer
19 views

Will changing the RSA Padding in OpenSSL cause issues?

I'm currently looking at changing the padding type from one of the Oracle Padding attacks to a secure one. Would this break data already encrypted using the old method?
1
vote
1answer
360 views

Understanding padding oracles - is an attack plausible in my scenario?

I have a scheme that, long story short, uses AES in CBC mode to encrypt third-party credentials for user accounts with a password-derived key. It's been mentioned that the use of CBC mode is a ...
1
vote
1answer
101 views

CBC-R when IV unknown

I've read the CBC-R description from Rizzo & Duong but am having trouble understanding the sequence of steps that would be taken when the IV is unknown and is not included with the ciphertext. ...
0
votes
3answers
58 views

Does a padding oracle have the encryption key? Where in real life do I see such an oracle?

So after some searching, I kinda know the attack procedure of altering bit by bit. But I'm still confused how this is possible. If I understand it correctly, the attacker never has the key, or tries ...
0
votes
1answer
46 views

Block cipher detect padding behaviour

Suppose i have a crypto provider, i.e: i give that provider some plaintext bytes and get the encrypted result. I don't know the used encryption method, but i know ...
0
votes
0answers
43 views

Attacking AES-CTR mode with known prefix [duplicate]

My question is the following: Consider a 128-bit AES-CTR mode encryption on a plain-text $m$ . The structure of $m$ is constant. First comes a string, let's say : "JustSomeText\" followed by 5 ...