2
$\begingroup$

I'm trying to understand the exploitability of the padding oracle attack, which enables someone to decrypt and encrypt the contents without knowing the encryption key.

Can encrypted data with the first block, be decrypted by the app that relies on a static IV without knowing the IV?

I want to understand the padding oracle attack's exploitability, especially to decrypt the first block of data using static IV. The Rijndael algorithm and CBC mode with PKCS7 padding I am familiar with. Due to unknown IV, I am unable to decrypt the first block, though.

I can perform this attack (demo environment) against an implementation that relies on Rijndael algorithm with CBC mode and PKCS7 padding. I'm able to decrypt all the blocks except the first one, because of the IV that 'I don't know'.

This attack makes it also possible to encrypt data without knowing the key. Suppose that the IV is static. Should it be possible to encrypt contents including the first block in such a way, that could be decrypted by the application that relies on a certain static IV, even without me knowing that IV? Otherwise, if I have an originally encrypted string (whose first block relies on the static IV), can I reuse something from the first block that I can use or feed to my own encryption process to ensure that the first block can be decrypted by the application that relies on the static IV?

My questions.

Can encrypted data be created that the program is using a static IV to decode it even if I don't know the IV?

Can I use the first block of a string who uses a static IV in the encryption to decode the block?

Is this attack possible with Rustpad?

I have a lot to learn about encryption so bare with me please.

The tool I use to exploit this attack (decryption/encryption) is Rustpad.

Source : Padding oracle attack.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

Can encrypted data with the first block, be decrypted by the app that relies on a static IV without knowing the IV?

No. To decrypt the first block of ciphertext, you must know the IV. See the diagram below (coped from Wikipedia) which shows how AES decryption works, in CBC mode:

Point (A) represents the first block of ciphertext, after being decrypted with AES using the key. Then, (A) is XOR'd with the IV (B), to produce the first block of plaintext (C). Without knowing the IV, the algorithm would have no way to produce the first block of plaintext. However, as you can see, the IV is only needed to produce the first block of plaintext - it is not used to produce the remaining blocks of plaintext.

As a related sidenote - this means that AES-CBC is susceptible to IV malleability. If the attacker knows the ciphertext and the key, and can control the IV, then he can carefully choose an IV to make the first block of ciphertext decrypt to a plaintext of his choice. See https://security.stackexchange.com/questions/217862/what-if-the-attacker-tamper-the-iv-used-in-the-block-cipher-cbc-mode for more info.

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ Indeed, to decipher the first block one needs the IV, and with unknown random IV nothing can be deduced about the first plaintext block. However in the question the IV is constant, thus there may be ways to obtain the IV from other decryptions. One way would be to obtain a known plaintext/ciphertext pair and use $\mathsf{IV}=P_1\oplus D(C_1)$ (where $P_1$ is the first padded plaintext block and $C_1$ the first ciphertext block). Another way would be to use that with a single ciphertext block $C_1$, $\mathsf{IV}\oplus D(C_1)$ is checked for padding. $\endgroup$
    – fgrieu ♦
    Apr 25 at 16:00
  • $\begingroup$ Thank you both for the clarification. This makes sense. $\endgroup$
    – VitoCorleone
    Apr 26 at 8:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.