A side-channel attack on implementations of encryption modes that use padding (e.g. ECB, CBC) that uses information leaked during decryption of tampered ciphertext values to derive information about the plaintext.

A padding oracle attack is a side-channel attack on implementations of block cipher modes that use padding, which utilizes information leaked by the implementation that indicates whether a submitted ciphertext results has invalid padding once decrypted.

By iteratively tampering with a ciphertext and observing information leakage indicating resulting padding errors when the tampered ciphertext is decrypted by the target implementation (the padding oracle), information about the plaintext value can be derived (in some cases the entire plaintext can be recovered).

Padding oracle attacks have been demonstrated against symmetric encryption schemes that use padding (such as the ECB and CBC block-cipher modes), and some asymmetric encryption padding schemes may also be vulnerable.

See the wikipedia page for more information.

history | excerpt history