3
$\begingroup$

If I have a string encoded with AES CBC with PKCS#5 padding, how can one possibly decrypt/crack it? What are the approaches that one can take to break its security?

$\endgroup$
1
$\begingroup$

You may take the following approaches:

  1. You can check if the key generation or storage has any weaknesses;
  2. You can check if padding oracle attacks apply;
  3. You can check if (part of) the ciphertext has been generated previously (using the same IV).

Neither of these methods work when AES CBC has been correctly applied. AES does provide adequate confidentiality, even for many ciphertext&plaintext pairs.

$\endgroup$
3
  • $\begingroup$ This answermay not be cover all attacks. $\endgroup$
    – Maarten Bodewes
    Feb 14 '13 at 11:59
  • $\begingroup$ Thanks for your answer, would you help me understand padding oracle attacks better? All of the articles I found on the net were too 'mathematical'. I'd like to learn in with a practical approach. $\endgroup$
    – Wise
    Feb 14 '13 at 18:13
  • $\begingroup$ A quick Google search already shows some results: limited-entropy.com/padding-oracle-attacks $\endgroup$
    – Maarten Bodewes
    Feb 14 '13 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.