I know that a protection against the padding oracle attack is to encrypt-then-mac. This is to avoid trying to decrypt a modified ciphertext, and leak information about padding errors.
Suppose that we have a content which is signed, and then encrypted. For decryption and signature control, this content is processed in the following manner:
- decrypt the content without telling if the padding is correct on not.
- check the signature on the decrypted content and return an error if it is incorrect, which should be the case if the ciphertext was modified.
Is this treatment correct when wanting to avoid PO attacks (or any other chosen ciphertext attacks)?
To be more precise, the scenario would be:
- the content is signed with an asymetric key (say a RSA-PSS signature),
- it's then encrypted with a symetric algo (say AES-256-CBC), with a random key and a random IV,
- the symetric key is encrypted with another asymetric key (say a RSA-OAEP encryption),
- the ciphertext, the encrypted symetric key and the IV are then transmited to a receiver process.
- the receiver process decrypts the symetric key without telling if there is a padding error (OAEP padding)
- it then decrypts the ciphertext with the (possibly badly decrypted) symmetric key without telling if there is a padding error (AES-256-CBC padding)
- it then checks the signature on the (possibly badly decrypted, but good sized) content and returns an error if it is incorrect, rejecting the received content.