CBC KEY recovery when KEY=IV

Question

We have access to an encryption and decryption server with the following implementation. How can we get the secret key by interacting with this server?

from Crypto.Cipher import AES

KEY = ?

def encrypt(plaintext):
    if len(plaintext)%16 != 0:
        return {"False"}

    cipher = AES.new(KEY, AES.MODE_CBC, KEY)
    encrypted = cipher.encrypt(plaintext)
    return {"ciphertext": encrypted.hex()}


def decrypt(ciphertext):
    cipher = AES.new(KEY, AES.MODE_CBC, KEY)
    if len(ciphertext)%16 != 0:
        return {"False"}
    decrypted = cipher.decrypt(ciphertext)
    try:
        decrypted.decode()
    except UnicodeDecodeError:
        return {"False"}
    return {"True"}

As we can see in the code, IV=KEY which is a vulnerability. The server also checks padding/decryption and returns True/False. I suspect this implementation is vulnrable to Padding Oracle Attack, but i still don't know how to get the KEY with these information. Any insights or guidance would be greatly appreciated. Thanks in advance!

Answer 1

Two hints:

• How can you craft a chosen plaintext so that the encryption will tell you the value of $E_k(k)$?

• Given the value of $E_k(k)$, how can you craft a chosen ciphertext so that the decryption will tell you the value of $k$? How can you make sure that the padding is valid (so that you don't get a decryption failure)?