I have read some articles or books (e.g., “Bulletproof SSL and TLS”) about POODLE, but they still don't answer my questions – which are:
From https://www.openssl.org/~bodo/ssl-poodle.pdf,
Usually, the server will reject this record, and the attacker will simply try again with a new request.
My question is:
Because this paper doesn't mention the attacker how to try again, I guess the attacker need try to modify the last byte ($C_{n-1}[15]$, from
0x00
up to0xFF
) of $C_{n-1}$ to reveal the cookies’ first previously unknown byte. I want to make sure if my understanding is correct or not?From Adam Langley's blog (https://www.imperialviolet.org/2014/10/14/poodle.html)
The critical part of this attack is that SSLv3 doesn't specify the contents of padding bytes (the •s). TLS does and so this attack doesn't work because the attacker only has a $2^{-64}$ or $2^{-128}$ chance of a duplicated block being a valid padding block.
My question is:
How does Adam get the chance ($2^{-64}$ or $2^{-128}$) in TLS?