# How to use CPA on AES128-CBC with constant Key and IV to leak info?

I'm doing a challenge in which I need to login to a server as an admin to capture a flag.
I can enter an $id$ and a $password$ only consists of 'a-z', '0-9','-', '_' characters.
The flow is as follows:

• The client side creates a message of a specific format: $$M = {id}\text{-}{password}\text{-}{cookie}$$ Where "$\text{-}$" acts as delimiter and $cookie$ is a constant postfix to ensure that the message was sent from the expected server (kind of like a signature).
• Then the client adds padding of null bytes and encrypts $M$ using AES128-CBC and the same key $k$ and same iv $IV$ is used every time, for which I don't have access to.
• The ciphertext is encoded in hex and sent (I do have access to the sent message)

After some analysis I found that if I obtain $cookie$ I can login as an admin.

1. What attack should I try to implement?
2. Can I get my hands on $IV$ or even $k$ using CPA when they are reused in CBC mode?
3. What additional information I should try to gather which can help me?
• Hint: Make your input so that exactly one byte of the cookie is still in the same block as your input. Now for every possible value of the byte make an encryption. Recover the byte from this. Repeat the process.
– SEJPM
Jul 25 '17 at 13:30
• You won't get the key, unless the programmer made a really bad mistake, like using the same value as key and IV. Jul 25 '17 at 15:16
• @SEJPM Nice solution! Jul 25 '17 at 19:41