# How to use CPA on AES128-CBC with constant Key and IV to leak info?

I'm doing a challenge in which I need to login to a server as an admin to capture a flag.
I can enter an $id$ and a $password$ only consists of 'a-z', '0-9','-', '_' characters.
The flow is as follows:

• The client side creates a message of a specific format: $$M = {id}\text{-}{password}\text{-}{cookie}$$ Where "$\text{-}$" acts as delimiter and $cookie$ is a constant postfix to ensure that the message was sent from the expected server (kind of like a signature).
• Then the client adds padding of null bytes and encrypts $M$ using AES128-CBC and the same key $k$ and same iv $IV$ is used every time, for which I don't have access to.
• The ciphertext is encoded in hex and sent (I do have access to the sent message)

After some analysis I found that if I obtain $cookie$ I can login as an admin.

1. What attack should I try to implement?
2. Can I get my hands on $IV$ or even $k$ using CPA when they are reused in CBC mode?
3. What additional information I should try to gather which can help me?
• Hint: Make your input so that exactly one byte of the cookie is still in the same block as your input. Now for every possible value of the byte make an encryption. Recover the byte from this. Repeat the process. – SEJPM Jul 25 '17 at 13:30
• You won't get the key, unless the programmer made a really bad mistake, like using the same value as key and IV. – CodesInChaos Jul 25 '17 at 15:16
• @SEJPM Nice solution! – Ariel Bereslavsky Jul 25 '17 at 19:41

The strategy you need to apply here, is basically the same as with most other oracle attacks:

You construct a message such that you can verify your guess for a single byte, then you adapt to guess the next byte until you are done.

In this specific case you would pick the user-controlled message length such that one byte of the cookie is in the same block as the tail of your message, encrypt that. Then you make your input one byte longer and try all possible values for the cookie byte until the corresponding block is equal to the encryption of the cookie byte.

Now you repeat this process for the second byte and so on.