I understand that the MAC-then-encrypt approach is susceptible to several attacks including the so called padding oracle attack. I understand that in this attack the attacker modifies the padding and listens for the errors caused which he can then use to infer the plain text. Can someone please explain the attack in layman's terms?
I would like to have the following addressed in the answers:
- How does the attacker listen for these errors? Does it mean the attacker is assumed to have some malware installed on the host machine doing the decryption?
- Is the attack based on a cipher text captured by the attacker, or a chosen cipher text selected by the attacker?