What is actual difference between POODLE and BEAST?

Question

I know that both attacks are based on the fact that the cipher used for communication is block cipher with CBC mode of operation and that is vulnerable because of predictable IV. Furthermore the original paper of POODLE claims that

"Unlike with the BEAST [BEAST] and Lucky 13 [Lucky­13] attacks, there is no reasonable workaround."

But openssl library seems to have implemented some mitigation technique known as 0/n split(to be fair I did not understand how that works either) and that seems to mitigate POODLE as well as BEAST. Then why research paper claims so?

Answer 1

• BEAST was indeed an attack on CBC mode with predictable (in fact known) IV in SSL3 and TLS1.0, because those protocols used the last block of the previous record, which (usually) has already been sent and seen by the adversary, as the IV for the next record.

  Record splitting blocks this by encrypting a (mostly) fixed stub record (at most one byte of data, plus HMAC and padding) using the known IV, producing quasi-random ciphertext, and in the same transmission sending (nearly) all the data in a second record using as IV the last block of the first record which is now not predictable. OpenSSL did 0/n splitting back in 2002 in response to an observation of this flaw by Rogaway, but it was widely disabled for interoperability; pretty much everybody else did 1/n splitting rapidly (weeks or months) in response to BEAST in 2011. The former is described adjacent to the document you linked at https://www.openssl.org/~bodo/tls-cbc.txt

  See also https://security.stackexchange.com/questions/17080/is-there-a-way-to-mitigate-beast-without-disabling-aes-completely

• POODLE is not an attack on IV at all; it is a padding oracle attack on the padding used in SSL3 (and it turned out some debatably defective TLS1.0 implementations also), hence the acronym Padding Oracle On Downgraded Legacy Encryption. Because POODLE has nothing to do with the IV, predictable or otherwise, fixing the IV has no effect on it.

  See canonical (and ursine) https://security.stackexchange.com/questions/70719/ssl3-poodle-vulnerability/ and perhaps (mine, but nearer) How does padding oracle attack work with bytes larger than possible length?