Find first two blocks of plaintext given a final plaintext block, the IV and ciphertext for CBC?

Question

I have the following:

• complete ciphertext;
• iv;
• last block of plaintext including the padding which is 04040404.

The encryption was made using AES-CBC-256. I can find the intermediate block by XOR-ing C2 with P3

I cannot use padding oracle because there is no server to validate padding. I didn't find any help about plaintext attack for 14 rounds, only for 4.

Is there any way to find the rest of plaintext (P1, P2) or the key for (C2 ⊕ P3, C3)?

Answer 1

Let's consider what you know: you have the last block, the IV, and the entire ciphertext. What you don't know is the key or the plaintext. Since CBC-mode encryption uses the IV directly only with the first block you must find the first block, before the IV even becomes useful for your attack. Since the CBC mode uses AES(plaintext[i] XOR ciphertext[i-1], key) and you know the plaintext of the last block, as well as the ciphertext of the previous block you end up with a generic known-plaintext case. So what can you do?

• Padding oracle attack:

  • You already said there's no server for a padding oracle attack so that's not possible

• Find the key using a known-plaintext attack on AES itself:

  • AES is designed to be secure against known-plaintext attacks, so there's not really much you can do. Unless, of course, you know something that the rest of the cryptography community doesn't...

Knowing the IV won't help since the IV only applies to the first block.

You know AES(something XOR iv, key) = ciphertext[0] but since you don't know the plaintext or the key it might as well be AES(something, key) = ciphertext[0]. Knowing what (something) is won't help either since you'll simply end up with another known-plaintext scenario, so even if you got the first block of plaintext as well the key is unobtainable - that's the point of encryption, and a padding oracle is an issue with the mode of operation, not the algorithm itself.

I'm sorry to say, you're SOL.