0
$\begingroup$

We have access to an encryption and decryption server with the following implementation. How can we get the secret key by interacting with this server?

from Crypto.Cipher import AES

KEY = ?

def encrypt(plaintext):
    if len(plaintext)%16 != 0:
        return {"False"}

    cipher = AES.new(KEY, AES.MODE_CBC, KEY)
    encrypted = cipher.encrypt(plaintext)
    return {"ciphertext": encrypted.hex()}


def decrypt(ciphertext):
    cipher = AES.new(KEY, AES.MODE_CBC, KEY)
    if len(ciphertext)%16 != 0:
        return {"False"}
    decrypted = cipher.decrypt(ciphertext)
    try:
        decrypted.decode()
    except UnicodeDecodeError:
        return {"False"}
    return {"True"}

As we can see in the code, IV=KEY which is a vulnerability. The server also checks padding/decryption and returns True/False. I suspect this implementation is vulnrable to Padding Oracle Attack, but i still don't know how to get the KEY with these information. Any insights or guidance would be greatly appreciated. Thanks in advance!

$\endgroup$
3
  • $\begingroup$ Your guess is of course probably right, as you don't seem to have all that much information otherwise. But you haven't indicated where you are stuck given this information. Have you tried to implement the padding oracle attack already? $\endgroup$
    – Maarten Bodewes
    Nov 29, 2023 at 20:21
  • $\begingroup$ @MaartenBodewes If i want to use padding oracle attack i have to find plaintext from a ciphertext by changing bits from last position but i already have the plaintext so i dont know how would i use this attack to find KEY! $\endgroup$
    – Sahar
    Nov 29, 2023 at 20:39
  • $\begingroup$ You can also use a plaintext oracle attack, but if a padding oracle attack is possible then that would be easier. There is a UnicodeDecodeError after all. $\endgroup$
    – Maarten Bodewes
    Nov 29, 2023 at 23:51

1 Answer 1

0
$\begingroup$

Two hints:

  • How can you craft a chosen plaintext so that the encryption will tell you the value of $E_k(k)$?

  • Given the value of $E_k(k)$, how can you craft a chosen ciphertext so that the decryption will tell you the value of $k$? How can you make sure that the padding is valid (so that you don't get a decryption failure)?

$\endgroup$
13
  • $\begingroup$ I couldnt figure out what you mean. Can you explain? $\endgroup$
    – Sahar
    Dec 1, 2023 at 12:35
  • $\begingroup$ @Sahar: do you know what processing is done during CBC mode encryption? In CBC mode decryption? $\endgroup$
    – poncho
    Dec 1, 2023 at 13:17
  • $\begingroup$ of course yes i know. $\endgroup$
    – Sahar
    Dec 2, 2023 at 11:04
  • $\begingroup$ @Sahar: ok, then, during encryption, how is the first ciphertext block generated? $\endgroup$
    – poncho
    Dec 2, 2023 at 14:02
  • $\begingroup$ C1 = enc(KEY, P1 XOR KEY) $\endgroup$
    – Sahar
    Dec 2, 2023 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.