New answers tagged cbc
Many different programs use CBC mode. It's secure and easy to implement (in comparision to some other modes). As already mentioned, SSL/TLS uses this mode. Or Keepass uses CBC mode.
If you can go through these lecture notes by Goldwaser and Bellare you will get the point
With byte aligned data, bit padding allows the padding oracle attack. Every message has to end in a 0x80 byte followed by any number of zero bytes. You can iterate one byte at a time just like with many other byte paddings. If you allowed plaintexts that are not a full number of bytes long, the attack wouldn't be possible. (Every plaintext that didn't end ...
TLDR: Don't invent your own protocol, use an existing one. Reusing an initialization vector with the same key is always a problem, even if the attacker is read-only. For CBC, you can see whether a beginning part of one message is the same as the beginning part of a different message (and you get to know the length of the common prefix, on block-level). ...
Top 50 recent answers are included