Assume I am the attacker. I want to break the plaintext by performing the padding oracle attack on AES CBC mode. I know the following information:

The ciphertext c
The length (bytes) of plaintext n
The AES padding uses PKCS#7
The 128-bit (16-byte) IV

How to break the plaintext p?

  • 4
    $\begingroup$ There is a description here, e.g. $\endgroup$ – Henno Brandsma Sep 8 '17 at 9:39
  • 1
    $\begingroup$ Or with code $\endgroup$ – Henno Brandsma Sep 8 '17 at 9:41
  • $\begingroup$ 1. You do not need to know the plaintext length. 2. The IV for AES is always 16-bytes. 3. You will not decode the first block. 4. A padding errors must be returned to the caller. $\endgroup$ – zaph May 31 '18 at 5:52

To explain this I am going to use terms for the attacker and message sender. Lets assume that Mallory is the one trying to perform this padding oracle attack and Bob is the one being attacked. The way the attack works is by using a divide and conquer approach to finding out the key byte by byte. Mallory continually sends forged messages to Bob and relies on the error messages that Bob sends back to her based on the correctness of her messages. Bob will tell Mallory when there is incorrect padding or incorrect verification on the MAC. Mallory then goes byte by byte and uses what seems like the correct padding to Bob, but really is taking advantage of the PKCS#7 padding standard. She then tries up to 256 combinations for each byte until one gives her the correct padding and MAC which she then stores. Mallory continues to do this byte by byte until she has every byte of the AES key figured out. This attack takes advantage of the extra error messages that Bob sends, which is how she succeeds in her attack even though the underlying block cipher is secure itself.

| improve this answer | |
  • $\begingroup$ There is no MAC in the question and it is ~128 requests per bit, not byte. If a message is "encrypt then MAC" no padding attack is possible (assuming the MAC is done correctly.) $\endgroup$ – zaph May 31 '18 at 5:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.