2
$\begingroup$

I try to understand a oracle Padding Oracle Attack example. I try to solve this question but I didn't figure out the answer.

A 7-byte message is padded per PKCS#5 and encrypted using the CBC mode of operation. The resulting ciphertext is
0x07 06 05 04 03 02 01 01, 0x08 09 0A 0B 0C 0D 0E 0F

Assume an Attacker modified that to
0x07 06 05 04 03 02 00 02, 0x08 09 0A 0B 0C 0D 0E 0F
and observed that the ciphertext was decrypted without any problems.

What is byte 7 of the original message?


What I did so far is separate the blocks as
Block 1: 0x07 06 05 04 03 02 00 02
Block 2: 0x08 09 0A 0B 0C 0D 0E 0F

The modified block is changed at the 7th and 8th byte so the key length should be 7. The Xor operation could be 0x02 xor 0x07 xor cipher text.

$\endgroup$
8
  • $\begingroup$ The tentative resolution of this homework is lacking. We can't tell "the key length", it could be e.g. 24 bytes if the block cipher is 3DES. Block size is 8 bytes: the question hints at that, and it's in the formal definition of PKCS#5 padding (RFC 8018 6.1.1 §4). If you think "xor 0x07" has to do with that padding, check Wikipedia's entry on PKCS#5 padding. The entry on CBC might also help. $\endgroup$
    – fgrieu
    May 10 at 8:45
  • 1
    $\begingroup$ Further hints: Since message is 7 bytes and padded per PKCS#5, what is the size of the padded message, and what are the byte(s) added by padding? What can be deduced about the nature of the first and second 8-byte blocks of the question's "ciphertext"? (note: CBC mode requires an IV and it must be transmitted somehow). How do these 2 blocks relate to the padded plaintext? What is the last byte of the deciphered (still padded) message obtained by deciphering per CBC the attacker's modified message? Assuming a maximally stringent PKCS#5 padding check, what must the previous byte be? Conclude. $\endgroup$
    – fgrieu
    May 10 at 9:14
  • $\begingroup$ I think the solution is hidden in the $F^{-1}(c)\oplus\mathsf{IV}$ formula. If the solution was reached when the password was tried by changing the data in the last 2 bytes, the fact that the result is similar when we xor these 2 values to each other gives us how many empty values the data is filled with. I think it can be solved successfully when we xor the given value with 05 and 06 consecutively. Based on this, I made the assumption that the data was filled with 02 02 02 02 in the parts after 6 bytes. $\endgroup$
    – MariaDb
    May 10 at 18:03
  • $\begingroup$ Given ciphertext: 0x07 06 06 05 04 04 03 02 02 01 01, 0x08 09 0A 0B 0C 0D 0E 0F Modified ciphertext: 0x07 06 06 05 04 03 02 00 02, 0x08 09 0A 0B 0C 0D 0E 0F We decrypt ciphertext using CBC mode and PKCS#5 padding, replacing the last two bytes (00 02) of the modified ciphertext to find a faulty padding in the last block: Our initial assumption: The last byte is a real padding byte, we add a padding byte with the same value as the last byte Ciphertext : 0x07 06 05 04 03 02 00 02, 0x08 09 0A 0B 0C 0D 0E 0F Deciphered text assume: 0x07 06 06 05 04 04 03 02 02 01 01, 0x08 09 0A 0B 0C 0D 0E 0F $\endgroup$
    – MariaDb
    May 10 at 21:13
  • 1
    $\begingroup$ Bit Flipping Attack on CBC Mode $\endgroup$
    – kelalaka
    May 12 at 22:27

1 Answer 1

1
$\begingroup$

Here is a guide to this is homework:

  1. We are told that "a 7-byte message is padded per PKCS#5". What does that perform? Name the outcome "padded message" and note that $P$. What is the length of $P$? What byte(s) have been added to the plaintext to form $P$ according to PKCS#5 padding? Therefore, what's the last byte of $P$?
  2. We see that the question gives the "ciphertext" as two blocks of 8 bytes. We need to make sense of that, for it does not match the length in step 1. Since this is CBC, we understand that the first block is actually the Initialisation Vector (IV), and the second block is the one block of actual ciphertext. Note $\mathsf{IV}$ for the first block, and $C$ for the second block (the first and only block of ciphertext that carries information about the message).
  3. Given how CBC works, what is the equation linking $\mathsf{IV}$, $P$, $C$, and the function $F$ performing block encryption (under whatever key is used, that we can't know; $F$ could for example be 3DES).
  4. When the attacker modifies the "ciphertext", what does it actually change ? Express that change as XOR with an 8-byte constant $Δ$, and determine $Δ$ explicitly.
  5. Name $P'$ the padded message after CBC decryption. Using the equation of step 3, what's the equation linking $P$, $P'$, $Δ$ ?
  6. What's thus the last byte of $P'$ ?
  7. We are told that "the ciphertext was decrypted without any problems", which includes padding checks. What can we thus deduce about other bytes of $P'$ ?
  8. Reusing the relation of step 5, what can we deduce about $P$? Conclude.

Clarifying the question's notation (already in the revised original): 0x is to indicate hexadecimal notation in the 8 bytes that follow (8 blocks of 2 hexadecimal characters separated by one space). The , is to visually separate 8 block bytes among the flow of bytes physically sent to the legitimate receiver.

Summary of PKCS#5 padding: it's objective is to prepare the plaintext, consisting of some arbitrary number of bytes (here, 7 bytes), for CBC encryption using a block cipher with 8-byte blocks. That requires transforming the plaintext into a padded plaintext of size a multiple of 8 bytes. This is performed by appending from 1 to 8 byte(s) to the message, such that the number of bytes added satisfies the requirement that the padded message has size a multiple of 8 bytes. The value of each byte added is the number of bytes added.
On decryption, PKCS#5 prescribes to check the padding: the last byte must be for 01 to 08, which tells the total number of padding bytes, and (when that's 2 to 8) the other padding bytes are (per PKCS#5 6.1.2 §5) checked to be equal to the last padding byte. These 1 to 8 padding byte(s) are removed in order to recover the plaintext with it's original length.

$\endgroup$
1
  • $\begingroup$ Please follow-up there. $\endgroup$
    – fgrieu
    May 13 at 8:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.