My question is about attacking PKCS#5 with CCA using the error feedback.
What we learnt in class about PKCS#5:
CBC requires padding to whole block boundary PKCS#5: standard padding
- If last plaintext block has 1 byte: pad with $\texttt{07}$ bytes
- If last plaintext block has 2 bytes: pad with $\texttt{06}$ bytes
- If last plaintext block has 7 bytes: pad with $\texttt{01}$ byte
- If last plaintext block has 8 bytes: pad with another block (8 bytes) of $\texttt{08}$.
And:
Decryption process: Apply 'regular' CBC-mode decryption Check padding:
- If padding Ok, remove and return plaintext
- If incorrect, abort with error
Up until now I understand everything. But the last part, describing a CCA attack on PKCS#5 with feedback, is what I can not understand:
Let $(c_1,...,c_8)=F_k(p_1,...,p_8)$ be some ciphertexts.
To find last byte $p_8$: Check which prev block gives Ok decryption
Let $x_8$ be the last byte of a block $X$ giving Ok padding
With high probability, $x_8 \oplus p_8 = \texttt{01}$...
And that's it.
First, I don't get where the IND-test is involved here.
In the test, attacker sends two messages $m_1$,$m_2$ and receives $c'$ which is an encryption of one of them, and has to distinguish which one exactly using the chosen-ciphertext capability, but here we just use the error result, as if the test is ignored.
Now, let's see if I understand that correctly:
$c_1$,...,$c_8$ are the bytes of some ciphertext block we wish to decrypt.
It says that in order to find out $p_8$ we find last block which gives ok on padding - let's assume we found one... this block looks like this: $c'=(c'_1,...,c'_8)$, and I know that the plaintext of $c'$ ends with $\texttt{01}$, or $\texttt{02},\texttt{02}$, etc.. until $\texttt{08},...\texttt{08}$ (8 times).
And now we denote the last byte (decrypted as plaintext) as $x_8$.
Why would $x_8 \oplus p_8$ be $\texttt{01}$ with high probability?
It would be great if someone could enlighten me up, I'm also open for other explanations instead the one I described here.
P.S. Read that question, seems related but I still can't understand how to deduce an answer about my question. Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?