Skip to main content

Questions tagged [padding-oracle]

A side-channel attack on implementations of encryption modes that use padding (e.g. ECB, CBC) that uses information leaked during decryption of tampered ciphertext values to derive information about the plaintext.

Filter by
Sorted by
Tagged with
1 vote
0 answers
36 views

crack AES CBC with chosen Ciphertext, IV and known plaintext [closed]

I am currently tackling a challenge involving AES CBC encryption where i have the ability to choose both the IV and the ciphertext, and then provide it to a service. The service decrypts with an ...
ucker's user avatar
  • 11
1 vote
0 answers
130 views

Random padding of RSA-signed message at end instead of beginning of the message

I’ve a signature scheme for 1024‒bit RSA with a 65537 exponent. The signed message is constructed as follows: 760‒Bits fully_user_controlled_message_content+8 Bits incremental nonce+sha256(...
user2284570's user avatar
0 votes
1 answer
104 views

CBC KEY recovery when KEY=IV

We have access to an encryption and decryption server with the following implementation. How can we get the secret key by interacting with this server? ...
Sahar's user avatar
  • 3
2 votes
1 answer
867 views

CTF - AES Padding Oracle [closed]

I am trying to solve another CTF challenge. The challenge consists in trying to exploit an oracle that decrypts any hex text we send (see code below). I am kind of stuck on this one as this is not a ...
Shark44's user avatar
  • 145
4 votes
1 answer
284 views

Is it possible to forge a RSA signature with a known public key, hardcoded padding, and unlimited oracle information?

I'm doing vulnerability research and looking at a device that is using some u-boot RSA encryption that they've modified. I've extracted the 4096-bit public key from the flash, it has an exponent of <...
deja's user avatar
  • 41
2 votes
1 answer
516 views

Padding Oracle Attack Example

I try to understand a oracle Padding Oracle Attack example. I try to solve this question but I didn't figure out the answer. A 7-byte message is padded per PKCS#5 and encrypted using the CBC mode of ...
MariaDb's user avatar
  • 31
3 votes
1 answer
178 views

Padding Oracle Attack with Length Prefix

I'm learning about the padding oracle and had a question about a modified padding oracle. Essentially the only difference is the length of the original message is prepended to the message as a 4 byte ...
user avatar
1 vote
1 answer
321 views

Stream cipher padding

Problem example Let's say I have a plaintext with length of 50 bytes. I want to encrypt it using a stream encryption algorithm ChaCha20-Poly1305. Poly1305 generate a 128 bit hash (16 bytes), so ...
Ergo's user avatar
  • 23
3 votes
2 answers
451 views

Is disabling padding integrity check in CBC implementations a good way of overcoming / mitigating padding oracle attack?

Given that CBC mode has a padding oracle attack, would disabling the padding integrity check be a good way of overcoming the vulnerability (this may result in frustration among existing users with ...
Ravindra HV's user avatar
0 votes
1 answer
808 views

Alternative to CBC mode encryption?

Given that CBC mode encryption is vulnerable to padding oracle attacks, what is the next best alternative ? a) Include a hash check in the API scheme, validate the hash and then proceed with CBC. If ...
Ravindra HV's user avatar
2 votes
0 answers
63 views

Prevent Bleichenbacher by adjusting Padding

I got the following question and I really don‘t know how to answer them. My I ask you for your input? Do you think, that the following adjusted Padding will prevent the classic Bleichenbacher attack <...
Random's user avatar
  • 21
0 votes
1 answer
445 views

Is CBC mode of encryption still safe as long as it's not use to send messages over a network?

I'm still reading about the Padding Oracle attack and Side Channel attack that can be performed to decrypt cipher text encrypted with CBC though it's still not clear to me. But base on my little ...
0xdeadbeef's user avatar
1 vote
1 answer
101 views

Revealing original message length having random padding

If I have a message that has a fixed unknown length $L$, and we add to it's TLS encryption a random sized padding $0\leq n \leq N$ so the sent message if $L+n$. I'm also able to make the target re-...
Lee's user avatar
  • 153
1 vote
0 answers
78 views

Where exactly do you add the zeroes to a URL in a padding oracle attack? Also, how would you decrypt a file this way?

I have been studying various crypto attacks, and one of the attacks that I have recently studied was the padding oracle attack. Now, I mostly understand it, but there is one aspect of the padding ...
Rikudou's user avatar
  • 13
1 vote
0 answers
47 views

Bleichenbacher CCA, proof of termination

I am currently thinking about how to prove that the algorithm presented in Bleichenbacher's paper (http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf) actually terminates. I know ...
user16910689's user avatar
1 vote
0 answers
53 views

Interval for PKCS#1 v1.5 compliant plaintext

In Bleichenbacher's paper (http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf, section 3.1) he concludes that if m*s is PKCS#1 v1.5 compliant we get the following interval: $2B \...
user16910689's user avatar
4 votes
1 answer
3k views

Is AES/CBC/NoPadding vulnerable to padding oracle?

If we used Cipher.getInstance("AES/CBC/NoPadding"), will it be vulnerable to padding oracle attacks?
Mengya Peng's user avatar
3 votes
4 answers
2k views

Does a cryptographic oracle have to be a server?

I've been told that oracles are always servers and that oracle attacks are always online, but I'm not convinced that's true. However, I have limited understanding of this topic since I'm still ...
user avatar
2 votes
2 answers
550 views

Padding Oracle Attack CBC Mode: If the set of characters of plaintext is known, then can you speed up the process

Consider AES-256, 128-bit blocks, and PKCS#5 Padding. During a Padding Oracle Attack, a manipulated byte of cipher text is sent to the oracle and we eventually hope to find out what that respective ...
SeesSound's user avatar
  • 141
2 votes
0 answers
241 views

Decrypting first byte of plain-text for AES CBC Padding Oracle Attack

I'm working on padding oracle attack and I have a 16 byte cipher on which I need to perform the attack. I've been able to successfully decrypt all the bytes of the plain-text except first byte and I'm ...
Alex's user avatar
  • 341
2 votes
2 answers
1k views

Are there actual consequences of padding oracle attacks?

I am writing a program that encrypts data in Python and heard about padding oracle attacks, but I think they are overrated (I mean, what are the real-world uses?) even for the old implementations that ...
KMG's user avatar
  • 403
3 votes
0 answers
90 views

How to extract message in Bleichenbacher 1998 attack

I'm trying to understand the Bleichenbacher 1998 attack, but I am having trouble wrapping my head around the bounds-part. So as far as I understand, the idea is the following: We have a ciphertext $c =...
FelRPI's user avatar
  • 151
5 votes
2 answers
3k views

During padding oracle attack (CBC), how is first byte of plaintext block is obtained?

Imagine conducting a padding oracle attack against CBC mode with 16-byte length blocks, and PKCS#5 used for padding. You start, as always, revealing the last byte of plaintext. Then you iteratively ...
bleg's user avatar
  • 51
1 vote
0 answers
139 views

Is this a valid alternative way to calculate plaintexts for a padding oracle attack?

I got a lecturer with a slightly way of writing down the padding oracle attack equations than what's considered to be the standard definition on the internet site like Wikipedia, and I wondered if all ...
user68610's user avatar
  • 111
7 votes
2 answers
20k views

Is the Java function AES/CBC/PKCS5Padding vulnerable to padding oracle?

I have an application that stores data on the devices. Currently AES/CBC/PKCS5Padding from javax.crypto.Cipher(see reference) is ...
GarlicCheese's user avatar
2 votes
0 answers
119 views

Do AEAD algorithms and encrypt-then-MAC mitigate external decryption oracles?

I'm curious about a possible attack scenario that I'm not sure exists. If it is possible, I'd like to know if and how AEAD algorithms and encrypt-then-MAC implementations protect against it. The ...
user70055's user avatar
1 vote
1 answer
943 views

How does the CBC Padding Oracle Attack work in General?

Right now we don't have a single generalized question asking how the CBC padding oracle attack works. We have e.g. this one and this one but the former is distracted by the concrete values being ...
SEJPM's user avatar
  • 46.1k
1 vote
1 answer
700 views

Help understanding how to decrypt cipher

I am trying to create a padding oracle attack to decrypt a cipher that is encrypted with cbc and PKCS#7 padding. My first step is just to try and decrypt the second block. I have read a lot about it, ...
yostart123's user avatar
9 votes
1 answer
3k views

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

Bleichenbacher demonstrated a padding oracle attack against RSA implementations that follow the PKCS #1 v1.5. Through the years, there are various mitigation techniques developed as OAEP and limiting ...
kelalaka's user avatar
  • 49k
2 votes
1 answer
508 views

Is every block padded with AES?

I am looking at a tutorial on the Oracle Padding Attack, and I wondered, how do you find the rest of the blocks(not the last one), if there's only padding on 1 block? Am I not understanding padding ...
Guy Sudai's user avatar
  • 125
6 votes
2 answers
2k views

Choice of padding scheme to prevent CBC padding oracle attacks?

I was watching a lecture about the padding oracle attack on CBC mode block ciphers, where the padding scheme used was PKCS#7. My question is can padding oracle attacks be prevented (without any use ...
amad-person's user avatar
4 votes
3 answers
2k views

Padding Oracle: Why should padding be 0x01?

I just finished reading about padding oracle attacks at https://blog.skullsecurity.org/2013/a-padding-oracle-example, and it blew my mind. I think I understand almost all of it, but I do not ...
kmort's user avatar
  • 165
-1 votes
1 answer
2k views

How can you change this message which is in block cipher AES-256 in CBC?

Given is the secret message encrypted with AES-256 in CBC mode 5a04ec902686fb05a6b7a338b6e07760 14c4e6965fc2ed2cd358754494aceffa The first 16 Byte is the initial ...
eyesima's user avatar
  • 101
1 vote
0 answers
133 views

Security implications of plaintext-padding in an AEAD-scheme

Let's say I have a secure AEAD-scheme like ChaCha20/HMAC and my encrypted blobs need to match a fixed size: Is it OK to apply some padding to my plaintext to match the block-size? Can I use any ...
K. Biermann's user avatar
0 votes
1 answer
6k views

How to perform the padding oracle attack on AES CBC?

Assume I am the attacker. I want to break the plaintext by performing the padding oracle attack on AES CBC mode. I know the following information: ...
TJCLK's user avatar
  • 497
8 votes
1 answer
2k views

Why was Vaudenay's original padding oracle attack not exploitable on TLS 1.0?

Reading Password Interception in a SSL/TLS Channel that was released in 2003: At Eurocrypt’02, Vaudenay presented vulnerabilities in padding schemes used for block ciphers in CBC mode. He used a ...
David 天宇 Wong's user avatar
1 vote
1 answer
1k views

Encrypting any text without key after padding oracle attack in CBC mode

Suppose the decryption program is already built. Now I want to encrypt an arbitrary plain text given the IV and the decryption program (no key). From the formulas, we have $$Dec(C_i)\oplus C_{i-1}=P_i$...
Simple Mistake's user avatar
4 votes
1 answer
505 views

Security effects of the seed's length in OAEP

In the OAEP scheme for asymetric encryption padding a random seed is used, whose length can be chosen. The paper which introduced OAEP in 1994 just states, that the seed's length $k_0$ should be ...
mat's user avatar
  • 2,528
2 votes
1 answer
369 views

CBC Padding Oracle in SSL3. Why only in SSL3 not in TLS1,TLS1.1, etc

I read about PODDLE attack which downgrades the TLS version to SSL 3.0 to exploit CBC padding oracle attack. I looked at the specs for TLS 1.1 And found CBC is still used in its ciphersuites. Why is ...
user6875880's user avatar
5 votes
1 answer
904 views

Zero padded signatures in the Bleichenbacher attack

I'm studying this attack and i have some doubts about it; let me explain with an example. Here is my decoded signature: 00 01 FF .. FF .. 00 ASN1 HASH I forge a ...
user43045's user avatar
0 votes
1 answer
249 views

Weird size of data transmitted in SSLv3

Note - I know SSLv3 is dangerous but that is why I am using it to do demo of POODLE attack using server and client written in python. So the question is I am using "ECDHE-RSA-AES128-SHA" cipher for ...
Vishvajeet Patil's user avatar
9 votes
5 answers
3k views

Is the 'Padding Oracle attack' deterministic?

I'm thinking about the example of Padding Oracle attack in CBC mode with PKCS7 padding given in Wikipedia. It says about the guess of the last byte in the plain text: In the worst case, they need ...
Lachezar Balev's user avatar
0 votes
1 answer
437 views

Cracking lowest plaintext bit in Padding oracle attack with PKCS#5

I have been working on a C implementation of padding oracle attack on a block encryption algorithm using CBC mode of operation. I understand the concept fine but I can't seem to find an answer to the ...
Donbhupi's user avatar
  • 103
1 vote
2 answers
4k views

Padding oracle attack, encrypting your own message

My understanding of the encryption attack on a padding oracle is that the attacker has a set of $P_i$'s and $\operatorname{Dec}(C_i)$'s I understand that by back calculating the attacker can find out ...
Ghazal's user avatar
  • 11
2 votes
2 answers
1k views

How does a Padding Oracle Attack work in practice?

I have understood how the padding oracle attack works in theory. Now, I am trying to visualize it in a real scenario. Can someone please give a real scenario in which an attacker can insert himself ...
Minaj's user avatar
  • 1,090
3 votes
1 answer
2k views

Attack RSA with PKCSv1.5 padding

I was reading an article about breaking RSA with PKCSv1.5 padding (http://mslc.ctf.su/wp/google-ctf-spotted-wobbegong-crypto-100/). It says that while retrieving the message we multiply by the ...
1010101's user avatar
  • 365
2 votes
2 answers
455 views

Clarification on the origin of `01` in this oracle padding attack?

I have found what I believe to be a straightforward explanation of the oracle padding attack here: http://robertheaton.com/2013/07/29/padding-oracle-attack/ I am however getting confused by something ...
Minaj's user avatar
  • 1,090
2 votes
2 answers
276 views

Layman's description of the padding oracle attack

I understand that the MAC-then-encrypt approach is susceptible to several attacks including the so called padding oracle attack. I understand that in this attack the attacker modifies the padding and ...
Minaj's user avatar
  • 1,090
2 votes
2 answers
722 views

Is this approach able to protect against padding oracle attacks?

I know that a protection against the padding oracle attack is to encrypt-then-mac. This is to avoid trying to decrypt a modified ciphertext, and leak information about padding errors. Suppose that we ...
bza's user avatar
  • 21
2 votes
1 answer
289 views

Will changing the RSA Padding in OpenSSL cause issues?

I'm currently looking at changing the padding type from one of the Oracle Padding attacks to a secure one. Would this break data already encrypted using the old method?
Matt's user avatar
  • 21