3
$\begingroup$

I'm learning about the padding oracle and had a question about a modified padding oracle. Essentially the only difference is the length of the original message is prepended to the message as a 4 byte string. It is then padded and encrypted as normal. How would the approach to this scheme be different from the standard padding oracle attack?

$\endgroup$

1 Answer 1

3
$\begingroup$

How would the approach to this scheme be different from the standard padding oracle attack?

Well, in a padding oracle attack, the attacker crafts a ciphertext (possibly using a valid ciphertext as a starting point), presents that ciphertext to the decryptor, and determines whether that ciphertext was rejected for invalid padding, or not.

So, to ponder this question:

  • In your proposed scheme, what would count as 'valid padding', and what would be rejected as 'invalid padding'?

  • Given the answer to the above question, how could an attacker craft a ciphertext to get some information about the decryption of one target ciphertext block?

I'm giving you hints, and not the answer, because you're learning, and solving things yourself teaches you much more thoroughly than being given handed the answer.

$\endgroup$
3
  • $\begingroup$ The oracle first checks whether the first 4 bytes (the length of the plaintext) is correct before checking correct padding, so I believe I need to force the first four bytes into the correct padding before I try the standard padding oracle attack. However, I'm unsure how to implement this. Any guidance would be appreciated. Thank you! $\endgroup$
    – user106946
    Feb 22, 2023 at 20:13
  • $\begingroup$ @AJGriffin: well, you have a valid ciphertext (actually, probably a number of them); how does that help? $\endgroup$
    – poncho
    Feb 22, 2023 at 20:28
  • $\begingroup$ Would it just be the same as a regular padding oracle attack except you pass in the entire cipher text block as you’re making changes to the end instead of 2 blocks at a time? I’d assume that only allows you to get the last block of plaintext because once you get past that, the prefixed length won’t be correct anymore. $\endgroup$
    – user106946
    Feb 22, 2023 at 22:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.