I have been learning a lot by studying the questions and answers here on crypto.stackexchange.com and an grateful for this community.

Recently in this question AES in CBC Mode Is totally unsecure if no defense is provided for padding oracle attack, right? I learned that CBC is secure against chosen plaintext attacks even though it isn't secure (by itself) against chosen ciphertexts attacks or padding oracles attacks. That makes sense to me.

From what I have learned so far, I would think that there are no cases where using a CBC encryption mode would be wise unless it were paired with some kind of authentication algorithm like HMAC. But from the answers for the linked question above I get the impression that perhaps that's not true, and there are cases where such use might be reasonable.

What is a specific example of where using CBC mode encryption (ex. AES-CBC) without pairing it with validation would be an appropriate and reasonable choice?

  • 2
    $\begingroup$ Where it has been historically done was Full-Disk-Encryption before everybody moved on to XTS, because CBC was too malleable for many people's taste. $\endgroup$ – SEJPM Feb 22 '17 at 13:37
  • $\begingroup$ @SEJPM that's super interesting. Seems like since 2002 when the padding oracle attack was discovered such uses would allow recovery of the plain bytes of data from such Full-Disk-Encryption. $\endgroup$ – RonC Feb 22 '17 at 13:41
  • 3
    $\begingroup$ Padding oracle attacks are pretty much irrelevant to FDE because you usually encrypt one sector (which is fixed at about 4kiB) and that is a perfect multiple of the block size meaning you don't need padding. (Note that my previous comment isn't an answer because it's not really sensible to use CBC for FDE because of the mentioned problems) $\endgroup$ – SEJPM Feb 22 '17 at 13:44
  • $\begingroup$ That definitely teaches me something. I know that PKCS7 is a common padding approach and that even when the data to be encrypted is a perfect length multiple of the block size it still pads by filling the whole next block with pad. But I hadn't considered that it is possible to use a CBC mode encryption algorithm by specifying Padding = No Padding and ensuring appropriate length of the data. That's cool. $\endgroup$ – RonC Feb 22 '17 at 13:49

Full disk encryption is only an example of encryption of data at rest. For that kind of usage CBC could suffice if only confidentiality is required. This is often the case if the user just wants to hide something, say an illegally downloaded movie. In that case you don't care if anybody can change the ciphertext, you just want to make sure that nobody finds out what is encrypted (possibly leaking the size of the file, which can be pretty unique for such large files, by the way).

The same goes for ransomware. If ransomware encrypts a file then the rightful owner can muck with the encrypted file as much as he wants; the data just gets further mangled. In this case I assume that there is no padding oracle attack, I suppose that the victim simply gets an application with the private key to decrypt files instead of the victim sending files over for decryption. That's one way to implement it anyway.

  • $\begingroup$ Comment here if you want to add stuff to this answer, and I'll turn it into a community wiki answer. $\endgroup$ – Maarten Bodewes Feb 23 '17 at 9:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.