# Creating own ciphertext after a padding oracle attack?

I've written a script that breaks a cipher text based on a padding oracle for an assignment, but was wondering how I would continue on to create my own cipher text with any plain text I desired?

Someone on the class forum mentioned XORing the intermediate step (or the $D(C_i)$ before XOR with $C_{i-1}$) (taken from the process of breaking the original cipher text) with the plain text of my choice to generate $C_{i-1}$. I don't see how this works, or if I misunderstood what the poster was XORing together. I see how $D(C_i) \oplus C_{i-1} = P_i$, but not sure how you can use your own plain text in that way.

I'm looking for hints on how to approach this, or a clarification on the 2nd paragraph.

• It sounds to me like they are trying to combine a MITM attack and padding oracle. CBC is vulnerable to both, but I cannot imagine a scenario where combining the two makes sense. Padding oracle is to recover plain text without a key. MITM here is to forge cipher text without a key that decrypts to plain text of your choosing. It makes no more sense to me than trying to combine "frying an egg" and "jump starting a car". Different skills, different applications. Maybe I am just overlooking something, but to me combining them makes no sense. – WDS Oct 9 '15 at 1:30
• The professor mentioned that it would require answering part 1 (breaking cipher with padding oracle) to answer part 2. I think I don't need to use the padding oracle directly perhaps, but it sounded like I needed something generated from solving part 1 to encrypt my own plaintext. – XeroAura Oct 9 '15 at 2:10
• OK, yeah, I see now. I was being dense. The MITM attack requires you know or correctly guess the plain text of the block you wish to alter. So OK, you use padding oracle to discover what that plain text is, then use the correct XOR to change that to the output you want. – WDS Oct 9 '15 at 2:14

## 2 Answers

I've written a script that breaks a cipher text based on a padding oracle for an assignment, but was wondering how I would continue on to create my own cipher text with any plain text I desired?

You cannot. The padding oracle attack does not give you enough information to produce the ciphertext for any plaintext. You can do it for some plaintext, though.

Simplest example is any one block message. Since the padding oracle attack gives you pairs $y = E(x)$, you can calculate for (padded) one-block plaintext $p$ the ciphertext $(x \oplus p) || y$ using any such pair. (Here the first block is the IV.)

You can also modify any block of the original message(s) captured if you are willing to scramble the previous plaintext block. This is what the person in the class forum was talking about:

You decide to modify $P_i$ to $P_i'$. Since $P_i = D(c_i) \oplus c_{i-1}$ and you want $P_i' = D(c_i') \oplus c_{i-1}'$, it suffices to let $c_{i-1}' = c_{i-1} \oplus P_i \oplus P_i'$. That changes $P_{i-1}$ to some random value unless you happen to know what $D(c_{i-1}')$ is and can calculate the plaintext (and even modify it by scrambling $P_{i-2}$ in turn).

You should be able to generate a ciphertext for any given plaintext using a padding oracle attack if you are using CBC mode. You'll need to be able to modify the IV though for it to fully work.

This is because every time you scramble an earlier block, you can just fix it by modifying the cipertext for the block before that (or the IV for the first block). If you can't modify the IV you are stuck with being able to modify all blocks except for the first (and the first one will become garbage).

The idea is to start from the end, and create a random ciphertext block $C_n$ (this can be fully random, a set of zeros, or any particular value you desire). When you then use the padding oracle attack against this block, you'll receive the decrypted value of this block: $\operatorname{Dec}(C_n)$ (as that is what the padding oracle can do for you: decrypt any ciphertext you pass into it, no matter whether it's valid or not).

Note, that $\operatorname{Dec}(C_n)$ will be garbage, but, since you are using CBC mode you can modify the preceding block $C_{n-1}$ in a way so it will actually XOR $\operatorname{Dec}(C_n)$ to your chosen plaintext $P_n$: $C_{n-1} := \operatorname{Dec}(C_n) \oplus P_n$.

Once you're done, continue the steps. You already know $C_{n-1}$, calculate $\operatorname{Dec}(C_{n-1})$ using the oracle, and then set $C_{n-2}$ so the CBC mode will XOR it into $P_{n-1}$, etc.

The only problem is with the first block. If you have access to set the $IV$ then it's not a problem, you just make sure the $IV$ is set to a value so it will XOR $\operatorname{Dec}(C_1)$ into $P_1$. Otherwise you are stuck, and you have to keep the first block as garbage.