I am looking at a tutorial on the Oracle Padding Attack, and I wondered, how do you find the rest of the blocks(not the last one), if there's only padding on 1 block?

Am I not understanding padding correctly?


1 Answer 1


Am I not understanding padding correctly?

You're not understanding the padding attack correctly.

Yes, only the last block is (typically) padded in CBC mode, however that doesn't mean that we can only attack the last block; what that means is that we can only use the last block.

In CBC-mode, the decryption of the block $i$ is computed as $P_i = D_k( C_i ) \oplus C_{i-1}$, where $D_k$ is the decryption using the unknown (to the attacker) key $k$. Now, the attacker can see $C_i, C_{i-1}$, and so if he can deduce the value $D_k( C_i )$, he then has found the value of the plaintext block $P_i$.

So, what the attacker does is construct ciphertexts where the $C_i$ appears as the last ciphertext block $C'_n$, and he tries various values for the next-to-last block [1] $C'_{n-1}$; he submits those ciphertexts, and sees if, after decryption, the had valid padding.

Whether they do (mostly) depends on the last decrypted plaintext block, which is $P'_n = D_k( C'_n ) \oplus C'_{n-1}$; by trying various values of $C'_{n-1}$, he can deduce the value $D_k( C'_n )$.

Hence, this padding oracle attack can be used to decrypt any block, not only the last.

[1] The penultimate block, if you (like me) prefer to use the term 'penultimate' correctly...


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.