3
$\begingroup$

I've been told that oracles are always servers and that oracle attacks are always online, but I'm not convinced that's true. However, I have limited understanding of this topic since I'm still learning and the book I just read didn't discuss it at all. The definitions I've seen of the term don't specify whether oracle attacks are always online/involve servers either.

  1. Is an oracle always a server?
  2. Can padding oracle attacks happen offline (e.g. an encryption tool)?
  3. Can partitioning oracle attacks happen offline (e.g. an encryption tool)?

Please explain things in layman's terms.

Improve this question
$\endgroup$

4 Answers 4

Reset to default
11
$\begingroup$

In Theory: No. How the Oracle is implemented or named is not important, only how it works.

In Practice: Everything that leaks information can be abstracted as an Oracle. So it is also possible to use the client as an oracle, or the systems processing the cryptosystems. The Server Client system is only the most common way how stuff works and communicates in the world wide web, but the important aspect is, that cryptography is used for a lot more that only "the internet".

A good example are operating systems. They are (for simplicity) offline systems, but you could also identify oracles and other mechanism in the cryptographic applications used for the OS. OS also use block ciphers, therefore it can be possible to make an offline padding oracle attack.

I hope I was able to give an adequate answer!

Improve this answer
$\endgroup$
4
  • $\begingroup$ That was a pretty good answer. It seems like that person was feeding me misinformation since they were mocking me for believing that oracle attacks could be performed offline. $\endgroup$
    – user87691
    Commented Mar 11, 2021 at 14:17
  • 3
    $\begingroup$ In theory you just need two parties: A verifier (for e.g. the program saying the padding is correct or not) and an attacker. There is no need for those attacks to be online. But it is simpler to imagine a Server and some Clients instead of speaking about programs and operating systems. Don't let others mock you, most of the time they have far less understanding in what they are talking about than you think they have :D $\endgroup$
    – Titanlord
    Commented Mar 11, 2021 at 14:27
  • 1
    $\begingroup$ Thanks :) That has clarified things nicely. $\endgroup$
    – user87691
    Commented Mar 11, 2021 at 14:31
  • 1
    $\begingroup$ Well, by definition an Oracle provides something of a service to the attacker. So that's the (theoretical) yes. That it's not just a service that can be provided over a network is another observation. Also by definition: you can certainly have an AES-CBC attack when using TLS when a server is sending data to a client, but the client then provides the "Oracle service" :) $\endgroup$
    – Maarten Bodewes ♦
    Commented Mar 11, 2021 at 20:55
4
$\begingroup$

The word online means controlled by or connected to another computer or to a network (Oxford).

The words query the oracle tells what you need and related to how your query is performed - online query and off-line query.

One queries the oracle then the oracle responds. Without a response, it is not an oracle. The response can be a bit or more, or even only return if there is an error ( wait x time, if not getting an error, you may assume it doesn't have an error).

  • The original padding oracle is executed online since the attacker doesn't have the encryption key and asks the oracle to check the padding is correct or not. If not correct, the oracle sends the padding incorrect error.

    This attack must be online since the attacker sends ciphertexts to the test. The server ( oracle) has the key to respond to the status of padding after the decryption.

    There can be a special case that creates the conflict; if an attacker has accessed your machine that has a program that responds to padding errors ( say the encryption and decryption can be executed in an HSM) then is this a local padding oracle attack or not? We can say still online since the attack created an online channel to execute the attack.

    If you are just trying to program padding oracles, then you may write a program that only responds to the padding status, this is a local padding oracle that has no use. This will be used in online padding oracle attacks.

    And, note that padding oracle is a decryption oracle that reveals the plaintext.

  • Partition oracle is also executed online, the attacker groups the keys produced by the KDF of passwords under a ciphertext and sends it to the server. The server responds tag as invalid or not.

    Note that the partition oracle is a key revealing oracle since the attacker learns the correct password with less query than usual online password attack. Since the password generates the key, they reach the encryption key.

To better understand the oracle; consider a gnome sitting in a box with a book and a pencil possible with a coin, too. If an encryption oracle then a key is also included.

  • Now you query a ciphertext to the gnome and it decrypts and returns padding is incorrect or not. That is padding oracle.

  • Now you query plaintext then the gnome returns the ciphertext. This is an encryption oracle. If the scheme is probabilistic the coin is tossed for the IV then the oracle returns with the probabilistic encryption.

  • Now you query ciphertext then the gnome returns the plaintext. This is a decryption oracle.

  • Now, you query a ciphertext and the oracle returns the tag status. This is authentication tag oracle that partition oracle is used.

  • Now, you send a message, and the gnome checks the book for existence, if exist returns from the book, if not the gnome toss coins, write the query to the book, and returns the value. This is random oracle

Normally, the box is not on the attacker's access. If they can access inside then the key is revealed. So we assume that, while constructing the oracle, the attacker has no access to the box other than query.

So this is about how the query is executed. If the query is executed online we can call this online oracle, if not off-line oracle ( if this helps). In practice, online attacks ( remote) are more considered.

As a special case, the oracle can be a TPM chip on your PC. You are attacking this chip as research then this is offline. But an attacker can also attack this remotely, then this is online.

Improve this answer
$\endgroup$
11
  • $\begingroup$ That's interesting, thank you. I thought partitioning oracle attacks could be executed offline. However, I'm not sure I understand why a padding oracle can't be executed offline. $\endgroup$
    – user87691
    Commented Mar 11, 2021 at 14:24
  • $\begingroup$ Well, one needs to distinguish the on-line and off-line. Can you call of-line if you are on the same machine ( not talking about cloud sharing)? Just freeze the system and read the memory for the encryption key. $\endgroup$
    – kelalaka
    Commented Mar 11, 2021 at 14:30
  • $\begingroup$ What I mean for instance is that there's a cryptopals CBC padding oracle challenge. Doesn't that involve executing a padding oracle attack offline? $\endgroup$
    – user87691
    Commented Mar 11, 2021 at 14:35
  • $\begingroup$ How you can do that if you don't have the key. They need you to provide a program that behaves like a server ( that must contain the key). You only test it locally then execute it online. Then you may call the local version as padding oracle, too. This, however, is only testing purposes. $\endgroup$
    – kelalaka
    Commented Mar 11, 2021 at 14:38
  • $\begingroup$ I thought a padding oracle attack didn't require knowledge of the key. If you had a file encryption program that used AES-CBC without HMAC and gave back invalid padding errors with the wrong key, then couldn't you execute the attack offline? The explanation from Microsoft seems to suggest this: docs.microsoft.com/en-us/dotnet/standard/security/… $\endgroup$
    – user87691
    Commented Mar 11, 2021 at 14:50
2
$\begingroup$

Oracle attacks are online in the sense used in protocol design, meaning that they involve back-and-forth communication between the attacker and the victim. The point of an oracle attack is that the attacker arranges to send some data to the victim somehow, and the victim somehow sends back some information that helps the attacker indidrectly figure out some secret information. The attack doesn't have to be “online” in the sense that it's connected to the Internet: for example, the attacker could be a local process, or the communication could take place over analog means, or the attack could take place before the Internet even existed (e.g. crib dragging was a form of oracle attack against Enigma).

The victim doesn't have to be a server. In fact, many famous oracle attacks target clients, for example BREACH (attack against a web browser) and Efail (attack against a PGP client).

Improve this answer
$\endgroup$
2
$\begingroup$

As I said in https://www.reddit.com/r/crypto/comments/m0gc2z/understanding_the_impact_of_partitioning_oracle/gqbciqj/, the oracle needs to have the decryption key.

You appear to still be under the impression that you can mount any kind of oracle attack when the oracle does not have the key (judging by your latest question to @kelalaka at Does a cryptographic oracle have to be a server?). This despite some patient explanations from @kelalaka I see in comments to that response.

Thinking about it in terms of "server" can be misleading, as I can see from your conversation with @titanlord. Perhaps you should ask him again "does a cryptographic oracle need to have the actual key?"

Improve this answer
$\endgroup$
2
  • $\begingroup$ Did you accidentally create 2 accounts? Look here if you need help. $\endgroup$
    – DannyNiu
    Commented Mar 12, 2021 at 6:58
  • 2
    $\begingroup$ @DannyNiu -- no I did not. The "Questioning xkcd__386" was created by someone who didn't like what I told him about oracles over on reddit, where my account name is xkcd__386. Someone alerted me to this post and I felt compelled to create an account and respond. See above for links and more info. $\endgroup$
    – xkcd__386
    Commented Mar 12, 2021 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.