2
$\begingroup$

I am mainly looking to perform this trick for fun. I have access to an API that uses WebCrypto under the hood for encrypt and decrypt methods. I would like to hijack the decrypt method in order to create a deterministic seed.

I have read other articles, and it seems like this trick should be relatively straight-forward, as AES-CBC does not have any integrity checks (that I know of). My understanding is that if the block-padding is correct, then a standard cipher-text payload should successfully decrypt using any secret key, even if that payload decrypts into random nonsense.

In practice, this doesn't appear to work, and I am not sure why. I can brute-force my way through by starting with a payload and iv of all zeroes, and incrementing by one until I produce a valid cipher-text that can be decrypted by a given key, but that cipher-text will fail when decrypted by another key.

I would like to figure out, if possible, how to craft a cipher-text that has no known solution, but can be decrypted by any given key in order to produce a deterministic random seed.

Any help or expertise would be greatly appreciated, as I would like to show this off for an upcoming hackathon event. Thank you!

Improve this question
$\endgroup$
3
  • 1
    $\begingroup$ You're failing because the PKCS#7 compatible padding will (most likely) fail. If you can try and use CTR mode instead, as it doesn't pad, or unpad. $\endgroup$
    – Maarten Bodewes ♦
    Jul 4 at 3:08
  • $\begingroup$ I think it's straight forward if the decryption key is fixed for every (attack) session. $\endgroup$
    – canary
    Jul 4 at 7:37
  • $\begingroup$ is it you who provides the IV to the Oracle decryption? if so, you can just try 256 IVs at most to get a valid decryption. $\endgroup$
    – canary
    Jul 4 at 7:44

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.