# Tag Info

5

You have to differentiate between it being theoretically OK and practically. Without fully checking, I can say that such an approach may be possible to fully prove. However, practically, it is almost impossible to implement it. Specifically, you have to be able to make it impossible to differentiate between an error due to the symmetric decryption or the ...

5

With pure asymmetric encryption there is no way to ensure integrity and authenticity, since anyone who knows your public key can encrypt any message for you. For that you would need either a symmetric key to use for a MAC (in which case you could use it/derivatives for symmetric encryption too) or a signature from the sender. And in the latter case the ...

3

Actually, we don't care about the amount of padding the original message had; we care whether the modified plaintext (that is, the result of the decryption of the modified ciphertext) has good padding or not. The padding will be valid if the last block had one of these patterns: XX XX XX XX XX XX XX 01 XX XX XX XX XX XX 02 02 XX XX XX XX XX 03 ...

3

Quoting the answer here: Padding Oracle attacks are mainly a problem in cases, where e.g. an encrypted message is modified and send to a target. These attacks try to measure the difference when decrypting and validating the message. The steps are: decrypting the message checking the padding > error if wrong checking or processing the ...

2

Yes, and it's devastatingly effective, too. See OAEP and other RSA/asymmetric-function padding standards. OAEP is what you should use these days so far as I am aware. PKCS#1 has other defined padding schemes also (eg PSS, PKCS1.5), only some of which are effective.

2

There are many examples of real padding-oracle attacks in practice. SSL/TLS is arguably the most famous example. However, they appear everywhere. In a paper by Practical Padding Oracle Attacks by Rizzo and Duong they find a number of interesting examples. But, they are really all over the place.

1

This article is quite sloppily written... We suppose that the padding is valid, this means that upon decryption of $C_1' + C_2$, the resulting plaintext will be correctly padded. And we want to show that then $P2'[16] = \mathtt{01}$. We can show this by contraposition: with our construction of $C_1'$ as 15 random bytes followed by $\mathtt{00}$, if \$P_2'[16] ...

1

the receiver process decrypts the symetric key without telling if there is a padding error (OAEP padding) The idea of OAEP padding is that you can check the correctness of the padding without being vulnerable to a padding Oracle attack. This is called "all-or-nothing" security. You could however replace the wrapped symmetric key with a previously wrapped ...

1

Yes, every RSA padding I'm familiar with is incompatible with the other schemes.

1

I am afraid there are no efficient methods of knowing the padding methods deployed unless it is specifically provided by description from whomever authored the original codes. You have to try bruteforcing the padding scheme to estimate what padding schemes are used.

1

For a CBC mode cipher, which is what POODLE applies to, you don't encrypt or decrypt individual bytes, but rather blocks, formed by adding padding to the actual data bytes. For encryption in general every byte can be any value 0 to 255, and the SSL spec allows the padding_length byte to be almost any value, but most if not all implementations only use 0 to L-...

1

You could look up the POODLE attack on SSL3 (pdf). It affected several implementations, but apparently e.g. OpenSSL 1.0.1i and earlier were affected. The idea is that an attacker can send modifier ciphertext for decryption (by a server which does know the key) and observe whether that results in correct padding. The pdf linked above outlines how it can be ...

1

In cryptography Oracle models a party in a given protocol that can answer to some precise questions. It is called Oracle because as the mythological Oracles, we don't know how they get the answer. This bit is very important in proven security as it allows to model a generic attacker and prove a protocol correctness against many possibles attackers. In real ...

1

I've written a script that breaks a cipher text based on a padding oracle for an assignment, but was wondering how I would continue on to create my own cipher text with any plain text I desired? You cannot. The padding oracle attack does not give you enough information to produce the ciphertext for any plaintext. You can do it for some plaintext, though. ...

Only top voted, non community-wiki answers of a minimum length are eligible