Tag Info

New answers tagged


I implemented this padding oracle attack some time ago in Python and remember this part being a bit confusing to wrap my head around, my code is as follows: newM = [] for (a, b) in M: # util.ceiling rounds arg1 / arg2 to the next highest integer rlow = util.ceiling((a*s - 3*B + 1), n) rhigh = (b*s - 2*B) / n for r in range(rlow, rhigh + 1): ...


I unfortunately don't have enough reputation to comment, forgive the answer that is a link to another answer. Your question is explained well in this answer: http://crypto.stackexchange.com/a/12706/17884


The biggest reason is probably that padding is required for CBC mode encryption. CBC mode encryption has been defined to provide confidentiality for the given message. What you are doing here is to mix the cipher mode used for confidentiality with the MAC required for authentication. By doing this you are decoupling the padding from the decryption: ...


How can you both "include the padding bytes in the calculation of the MAC? Verify the MAC before even looking at the padding" It sounds like your construction is trying to be Encryption: m0 || m1 || m2 || padding || padding of padding || MAC of m0+m1+m2+first padding --CBC--> ciphertext Decryption and Verification: Decrypt entire message Extract ...

Top 50 recent answers are included