This is my first post on stack overflow/stack exchange so please excuse me if I asked the question in a bad way or the format is bad.

I am currently working through the cryptopals challenges and I got stuck on this one: https://cryptopals.com/sets/2/challenges/12 where you basically need to figure out a secret by extracting one byte a time exploiting AES-ECB (You are given a function which encrypts usertext + secret and encrypts it with AES-ECB). I understand why this attack works but what I don't understand is how we can extract more than one block size worth of bytes of the secret. Because let's say for block size = 8. We do the attack and discover the first eight bytes of secret, how can we get all the other bytes of secret as whatever amount of bytes we will enter now only parts of the first block size of secret will get discovered.

  • 2
    $\begingroup$ Once you discovered the last byte, shift left one byte and try the rest. The idea is you know the contents of the 7 but try the eight. $\endgroup$
    – kelalaka
    Jan 20 '21 at 22:53
  • $\begingroup$ @kelalaka I still don't understand how that will help me. Assuming I understood your comment correctly I will take the 7 last bytes of the 8 bytes of secret we discovered and feed the function those bytes. The function will add the the first byte of secret which we already had discovered and lead us nowhere. Am I missing something ? $\endgroup$
    – CryptoNoob
    Jan 20 '21 at 23:09

You have and oracle call of

$$O(\texttt{your-string}) = (\operatorname{AES-128-ECB}(\texttt{your-string} || \texttt{unknown-string})$$

Since you know that the AES has 16-byte block cipher and it uses CBC, request;

$$C = O(\texttt{AAAAAAAAAAAAAAAx})$$ from oracle, where $\texttt{x}$ is the first byte of the random key.

Now ask to oracle these encryptions $$C = O(\texttt{AAAAAAAAAAAAAAA[a..zA..Z]})$$ and see which character is equal to $\texttt{x}$, sat $1$

Now once we determine the $\texttt{x}$, we can move to the next one. Request from Oracle;

$$C = O(\texttt{AAAAAAAAAAAAAAxy})$$

Now ask to oracle these encryptions $$C = O(\texttt{AAAAAAAAAAAAAAx[a..zA..Z]})$$ and see which character is equal to the second byte $\texttt{y}$ of the string, say $2$

With this method, we can get 16 bytes of the secret. What about if there are more. Request

$$C = O(\texttt{AAAAAAAAAAAAAAA1})$$

then request this will provide the next block's encryption as the input

$$\texttt{234567890abcdef}$$, where you know $\texttt{234567890abcde}$ but not $\texttt{f}$, but you got the encryption of this block. Now ask the oracle

$$C = O(\texttt{234567890abcde[a..zA..Z]})$$

to determine the 17th byte $\texttt{f}$, the rest is similar.

  • $\begingroup$ While I understand How this will work for the first block size number of bytes I don't understand how I can reveal more than that amount of bytes from the secret as let's say for example I put 1 byte into the oracle I will get 15 bytes of the secret that I already discovered. Sorry If I'm missing something obvious here. $\endgroup$
    – CryptoNoob
    Jan 20 '21 at 23:40
  • $\begingroup$ @CryptoNoob yes, that was misleading, check the update. $\endgroup$
    – kelalaka
    Jan 21 '21 at 0:49
  • $\begingroup$ Okay I think I understand now. Basically instead of looking at the first block after discovering the first 16 bytes. We disregard the first 16 bytes and fill the second block with 15 bytes which we know and look at the last byte which we don't know which is the 17th byte. $\endgroup$
    – CryptoNoob
    Jan 21 '21 at 0:54
  • $\begingroup$ Yes, that's it. $\endgroup$
    – kelalaka
    Jan 21 '21 at 0:56
  • $\begingroup$ Thanks alot for the help and patience. $\endgroup$
    – CryptoNoob
    Jan 21 '21 at 1:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.