Suppose i have a
crypto provider, i.e: i give that provider some plaintext bytes and get the encrypted result.
I don't know the used encryption method, but i know it is using a block cipher and the Block cipher mode of operation is something behaving like ECB (every block is encrypted individually => 2 identical blocks of plaintext should lead to 2 identical blocks of ciphertext, if there is no prefix) and thus vulnerable to different padding attacks.
crypto provider may add a prefix and suffix to the plaintext but i don't know if and how long they are.
I want to execute different padding attacks on this
crypto provider (Detect prefix and suffix length, bruteforce suffix in linear time, strip pre- and suffix, ...).
In fact everything works, but i need to know if the padding method used by the
crypto provider is appending a padding block if the
length of the plaintext % blocksize == 0. Otherwise my calculation of the length of prefix + suffix might be wrong.
Giving the described circumstances, is there a way to detect this without having to test for the exact used padding scheme ?
What i do atm:
To detect the
suffix length i start with encrypting one byte, get the length of the cipertext (
cipher_a) and then add one byte to the plaintext (
plaintext_n) till the length of the cipyertext (
cipher_n) is larger as the first one.
Now i know:
blocksize = length(cipher_n) - length(cipher_a)
If the padding used DOES add an empty padding block:
fixes_length = length(cipher_a) - length(plaintext_n)
fixes_length = length(cipher_a) - length(plaintext_n) -1
Short example which (hopefully) shows the problematic.
blocksize = 3,
prefix = "xx",
suffix = "yy":
With an empty padding block:
╔═══════╦═════════════╦═════════╗ ║ Chars ║ Plaintext ║ Blocks ║ ╠═══════╬═════════════╬═════════╣ ║ 1 ║ xxa yy- ║ 2 ║ ║ 2 ║ xxa ayy --- ║ 3 ║ ╚═══════╩═════════════╩═════════╝
In this case the calculation is correct.
blocksize = 3
fixes_length = 6 - 2 = 4
Without an empty padding block:
╔═══════╦═════════════╦═════════╗ ║ Chars ║ Plaintext ║ Blocks ║ ╠═══════╬═════════════╬═════════╣ ║ 1 ║ xxa yy- ║ 2 ║ ║ 2 ║ xxa ayy ║ 2 ║ ║ 3 ║ xxa aay y-- ║ 3 ║ ╚═══════╩═════════════╩═════════╝
This fixes_length is wrong.
blocksize = 3
fixes_length = 6 - 3 = 3
I am relatively new to cryptography, so please excuse me if i got some terminology wrong