I just finished reading about padding oracle attacks at https://blog.skullsecurity.org/2013/a-padding-oracle-example, and it blew my mind. I think I understand almost all of it, but I do not understand one critical thing:
When looking for good padding, why should the first one (last byte of the message) be 0x01
when you've found the right symbol? Additionally, why should the pattern for the next to last byte be 0x02 0x02
and the next 0x03 0x03 0x03
, etc.
I understand the padding scheme requires that if you have 4 bytes of padding, the bytes should be 0x04
, 0x04
, 0x04
, 0x04
. And if you have 2 bytes of padding, it should be 0x02
, 0x02
, etc. That's not the problem. The problem I do not understand is: Why should you get padding when you decrypt your now-modified sequence of bytes?
In other words, pretend I had the string "Hello!" and a block size of 8 bytes. I would expect there to be two bytes of 0x02
padding after whatever the encrypted "Hello!" string turns out to be. Now, in the attack, I add 8 bytes of zeros before it, run it through decryption, incrementing the last byte until I get valid padding. I do not understand why the padding should be 0x01 at this point, not 0x02, as was in the original. Similarly, when it moves on to the next byte to figure out, they are looking for 0x02, and 0x03 for the next, etc. Why is this?