I'm quite new to the topic and read a bit about poodle and padding oracle.
I quite understand the "regular" padding oracle attack, substituting the last byte of block(n-1) to determine the last byte of block(n) - by "myguess" XOR 0x01 for the last byte and so on.
Articles on poodle however state, that the attack is based on placing my target block to replace the padding. As the padding is not checked, the server will accept the message if the last byte of my replacement happens to be the length of the padding, as the server will cut the padding correctly and be able to check the MAC.
Now, as stated here there always is padding, as you could not otherwise know, if the message just happened to fit into blocks.
I understand poodle to work like this:
- i forge request with javascript, forcing the victims' browser to copy the encrypted sessioncookie-block as padding
- i create at max 256 of these requests, moving my cookie-block further down the line, thus creating longer and longer paddings until the server accepts the request, telling me that the decrypted last byte is the position of the last byte in the forged padding
- i "write down" the last byte, drop it and repeat the process with the second to last byte and so on.
if the last byte of my sessioncookie now happens to be FF, is would need a padding of 255 bytes length, which is multiple blocks of just padding.
Will sslv3.0 implementations just accept that i padded more than is reasonably neccessary?
Or have i misunderstood the concept? I have not found an article really explaining in detail.
I'm glad for links to detailed technical descriptions, videos, most of all for simple corrections in my description of the process if it isn't correct.