0
$\begingroup$

Suppose i have a crypto provider, i.e: i give that provider some plaintext bytes and get the encrypted result.
I don't know the used encryption method, but i know it is using a block cipher and the Block cipher mode of operation is something behaving like ECB (every block is encrypted individually => 2 identical blocks of plaintext should lead to 2 identical blocks of ciphertext, if there is no prefix) and thus vulnerable to different padding attacks.
The crypto provider may add a prefix and suffix to the plaintext but i don't know if and how long they are.

I want to execute different padding attacks on this crypto provider (Detect prefix and suffix length, bruteforce suffix in linear time, strip pre- and suffix, ...).
In fact everything works, but i need to know if the padding method used by the crypto provider is appending a padding block if the length of the plaintext % blocksize == 0. Otherwise my calculation of the length of prefix + suffix might be wrong.

Giving the described circumstances, is there a way to detect this without having to test for the exact used padding scheme ?

What i do atm:
To detect the blocksize and prefix + suffix length i start with encrypting one byte, get the length of the cipertext (cipher_a) and then add one byte to the plaintext (plaintext_n) till the length of the cipyertext (cipher_n) is larger as the first one.
Now i know:
blocksize = length(cipher_n) - length(cipher_a)
If the padding used DOES add an empty padding block:
fixes_length = length(cipher_a) - length(plaintext_n)
Otherwise:
fixes_length = length(cipher_a) - length(plaintext_n) -1

Short example which (hopefully) shows the problematic.
Suppose: blocksize = 3, prefix = "xx", suffix = "yy":
With an empty padding block:

 ╔═══════╦═════════════╦═════════╗
 ║ Chars ║ Plaintext   ║ Blocks  ║
 ╠═══════╬═════════════╬═════════╣
 ║ 1     ║ xxa yy-     ║ 2       ║
 ║ 2     ║ xxa ayy --- ║ 3       ║
 ╚═══════╩═════════════╩═════════╝

In this case the calculation is correct.
blocksize = 3
fixes_length = 6 - 2 = 4

Without an empty padding block:

 ╔═══════╦═════════════╦═════════╗
 ║ Chars ║ Plaintext   ║ Blocks  ║
 ╠═══════╬═════════════╬═════════╣
 ║ 1     ║ xxa yy-     ║ 2       ║
 ║ 2     ║ xxa ayy     ║ 2       ║
 ║ 3     ║ xxa aay y-- ║ 3       ║
 ╚═══════╩═════════════╩═════════╝

This fixes_length is wrong.
blocksize = 3
fixes_length = 6 - 3 = 3

I am relatively new to cryptography, so please excuse me if i got some terminology wrong

$\endgroup$
1
$\begingroup$

I am afraid there are no efficient methods of knowing the padding methods deployed unless it is specifically provided by description from whomever authored the original codes. You have to try bruteforcing the padding scheme to estimate what padding schemes are used.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.