Assume I am the attacker. I want to break the plaintext by performing the padding oracle attack on AES CBC mode. I know the following information:
The ciphertext c
The length (bytes) of plaintext n
The AES padding uses PKCS#7
The 128-bit (16-byte) IV
How to break the plaintext p?
To explain this I am going to use terms for the attacker and message sender. Lets assume that Mallory is the one trying to perform this padding oracle attack and Bob is the one being attacked. The way the attack works is by using a divide and conquer approach to finding out the key byte by byte. Mallory continually sends forged messages to Bob and relies on the error messages that Bob sends back to her based on the correctness of her messages. Bob will tell Mallory when there is incorrect padding or incorrect verification on the MAC. Mallory then goes byte by byte and uses what seems like the correct padding to Bob, but really is taking advantage of the PKCS#7 padding standard. She then tries up to 256 combinations for each byte until one gives her the correct padding and MAC which she then stores. Mallory continues to do this byte by byte until she has every byte of the AES key figured out. This attack takes advantage of the extra error messages that Bob sends, which is how she succeeds in her attack even though the underlying block cipher is secure itself.
