If we used Cipher.getInstance("AES/CBC/NoPadding"), will it be vulnerable to padding oracle attacks?

• Usually, the plaintexts are not 128-bit oriented. the NoPadding usually means that I'll handle the padding. Do you really have 128-byte oriented plaintexts or do you have something else in your mind? Apr 22 at 13:05

If there is no padding then the cipher is not vulnerable to padding oracle attacks that originate from the cipher implementation. The cipher expects full blocks of ciphertext and simply decrypts them to whatever information, even if that seems random.

However, padding oracle attacks are part of a larger set of attacks called plaintext oracles. Plaintext oracles react to information that is released by an implementation when the plaintext is altered. As CBC doesn't provide message integrity the attacker can perform any kind of change.

The most simple example is if the code itself pads / unpads the message using e.g. PKCS#7 padding. In that case, the padding oracle is not present in the cipher, but present in the code surrounding the cipher. It would be just as bad as a padding oracle attack that was created by using the cipher implementation.

Another, less obvious examples of plaintext oracles are the attacks on the XML-encryption standard. Those are at least as efficient as padding oracle attacks.

Of course, as always, the plaintext oracle must need to be present; for instance, local file encryption may not expose an online oracle. And as always, plaintext oracles are best avoided by adding a message authentication tag for message integrity (such as a HMAC calculation over the IV and message, or by using an authenticated / AEAD cipher such as GCM).

• So does it means "AES/CBC/NoPadding" is weak and we should change it to "AES/GCM/NoPadding"? What about for "AES/CBC/PKCS5Padding"? Apr 22 at 10:34
• If it is weak or not depends on the context and how it is deployed - generally you'd prefer GCM, yes. Apr 22 at 10:37
• What about using "AES/CBC/NoPadding" with CTS (Cipher Text Stealing)? Does it still be vulnerable for padding oracle? Should we change to GCM mode? May 10 at 10:38
• No, CTS is not vulnerable, but it has it's own drawbacks; it is not always available, has 3 schemes to choose from. It is not used much, mainly because most cryptographers would probably choose a stream cipher or stream cipher mode - such as counter mode) over CTS. May 10 at 10:49
• Thanks for your explanation. May 10 at 11:18