Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
14 votes
Accepted

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

How does the new attack work at top level? In short They used BEAST-like Man in the Browser attack by using Cache-like attacks to perform a downgrade attack against any TLS connection to a ...
kelalaka's user avatar
  • 48.8k
11 votes

Does a cryptographic oracle have to be a server?

In Theory: No. How the Oracle is implemented or named is not important, only how it works. In Practice: Everything that leaks information can be abstracted as an Oracle. So it is also possible to use ...
Titanlord's user avatar
  • 2,309
7 votes
Accepted

Is every block padded with AES?

Am I not understanding padding correctly? You're not understanding the padding attack correctly. Yes, only the last block is (typically) padded in CBC mode, however that doesn't mean that we can ...
poncho's user avatar
  • 148k
7 votes
Accepted

Why was Vaudenay's original padding oracle attack not exploitable on TLS 1.0?

It's a question of attack model. Vaudenay places himself in a model where the attacker is "outside", and trying to work out the password that a human user enters in a Web site (or another similar ...
Thomas Pornin's user avatar
7 votes

During padding oracle attack (CBC), how is first byte of plaintext block is obtained?

Does PKCS#5 allow you to pad 16 bytes with 0x10 value? No, but that's because PKCS#5 only specifies padding for DES, and that has an 8 byte block size. Even PKCS#5 ...
Maarten Bodewes's user avatar
  • 93.1k
7 votes
Accepted

Are there actual consequences of padding oracle attacks?

I mean this is the server bug that it doesn't take a key in the first place and check if it's correct :) What do you mean with that? The key must be the right one, and the padding oracle attacks ...
Maarten Bodewes's user avatar
  • 93.1k
5 votes

Choice of padding scheme to prevent CBC padding oracle attacks?

Padding oracle attacks are not the padding scheme's fault! They are not fixed by changing the padding! They are fixed by not leaking partial information about the result of decryption, or (preferably) ...
Mikero's user avatar
  • 13.4k
5 votes
Accepted

Is the 'Padding Oracle attack' deterministic?

These should both be valid paddings: ... ... ... 68 02 02 ... ... ... 68 02 01 But if this ambiguity comes up, we can distinguish between the two by modifying ...
ilkkachu's user avatar
  • 903
5 votes

Is this approach able to protect against padding oracle attacks?

You have to differentiate between it being theoretically OK and practically. Without fully checking, I can say that such an approach may be possible to fully prove. However, practically, it is almost ...
Yehuda Lindell's user avatar
5 votes
Accepted

Is the Java function AES/CBC/PKCS5Padding vulnerable to padding oracle?

The problem with CBC mode is the padding. When there is a padding error, the server must respond to a message back to you so that you can send the message back again or encrypt the message from the ...
kelalaka's user avatar
  • 48.8k
5 votes

During padding oracle attack (CBC), how is first byte of plaintext block is obtained?

So, how do you reveal the first byte of a block, since you’re out of padding length? We are are not out of padding length. However, PKCS#5 (rfc 2898) is defined for 8-byte blocks i.e. for 64 block ...
kelalaka's user avatar
  • 48.8k
5 votes

Are there actual consequences of padding oracle attacks?

I am asking to know if this attack is just a one with no real world implications and no real data decryption capabilities(actual data) . The Lucky Thirteen attack is a real-world attack against TLS. ...
Gilles 'SO- stop being evil''s user avatar
4 votes

How does a Padding Oracle Attack work in practice?

Here's a real-world example: A captcha service behaves as follows. First, it generates a distorted image of some known text $t$. It sends then image to a web browser, and waits for a response. It ...
Mikero's user avatar
  • 13.4k
4 votes

Is the 'Padding Oracle attack' deterministic?

I am afraid you didn't understand the algorithm of the padding oracle. I suggest studying the algorithm given at Vaudenay's original article on this. He is very concise in what he writes in the ...
phazer's user avatar
  • 41
4 votes

Padding Oracle Attack CBC Mode: If the set of characters of plaintext is known, then can you speed up the process

I will assume you generally understand the mechanics of the padding oracle attack. Say we have some ciphertext block $c_i = c_{i-1} \oplus E(k,m_i)$ and we want to find the last byte of $m_i$. Let $b$ ...
Mikero's user avatar
  • 13.4k
4 votes

Does a cryptographic oracle have to be a server?

The word online means controlled by or connected to another computer or to a network (Oxford). The words query the oracle tells what you need and related to how your query is performed - online query ...
kelalaka's user avatar
  • 48.8k
4 votes

Is AES/CBC/NoPadding vulnerable to padding oracle?

If there is no padding then the cipher is not vulnerable to padding oracle attacks that originate from the cipher implementation. The cipher expects full blocks of ciphertext and simply decrypts them ...
Maarten Bodewes's user avatar
  • 93.1k
4 votes
Accepted

Stream cipher padding

Is it safe to use padding with an authenticated stream cipher like ChaCha20-Poly1305? Yes, assuming you authenticate the padding so it can't be tampered with. Applying the padding before encryption ...
samuel-lucas6's user avatar
3 votes
Accepted

How can you change this message which is in block cipher AES-256 in CBC?

The diagram you have there is for encryption... decryption is basically upside down: Notice that the ciphertext is decrypted and then XORed to produce the plaintext. You simply need to manipulate the ...
jadb's user avatar
  • 437
3 votes
Accepted

Security effects of the seed's length in OAEP

Let's start with the preliminaries. The basic scheme has encryption defined as follows: $$\mathcal{E}^{G, H}(x) = f(x \oplus G(r) || r \oplus H(x \oplus G(r)))$$ Some definitions: $f: \{0,1\}^k \...
puzzlepalace's user avatar
  • 4,042
3 votes

Layman's description of the padding oracle attack

Quoting the answer here: Padding Oracle attacks are mainly a problem in cases, where e.g. an encrypted message is modified and send to a target. These attacks try to measure the difference when ...
Ella Rose's user avatar
  • 19.6k
3 votes
Accepted

Clarification on the origin of `01` in this oracle padding attack?

Actually, we don't care about the amount of padding the original message had; we care whether the modified plaintext (that is, the result of the decryption of the modified ciphertext) has good padding ...
poncho's user avatar
  • 148k
3 votes

Attack RSA with PKCSv1.5 padding

First of all, this attack assumes that we have a decryption Oracle; that is, an Oracle that we can submit any ciphertext to (except for, apparently, the challenge ciphertext), and it will tell us that ...
poncho's user avatar
  • 148k
3 votes

Zero padded signatures in the Bleichenbacher attack

Why does RSA accept a 0x00 padded cube root as encoded signature? It is not correct to assume that a valid RSA signature always starts with a byte containing a few bits set to one. An RSA signature ...
Maarten Bodewes's user avatar
  • 93.1k
3 votes
Accepted

Weird size of data transmitted in SSLv3

You won't find the answer in the RFC; instead, here's what your SSL implementation is doing: when you send a single byte of data, it actually generates two records. The first record is empty; so it ...
poncho's user avatar
  • 148k
3 votes
Accepted

Alternative to CBC mode encryption?

GCM is a very good alternative, it provides built in message authentication, so encrypted messages can not be manipulated by an attacker. The encryption itself is based on CTR mode which is well ...
Meir Maor's user avatar
  • 11.8k
3 votes

Padding Oracle Attack with Length Prefix

How would the approach to this scheme be different from the standard padding oracle attack? Well, in a padding oracle attack, the attacker crafts a ciphertext (possibly using a valid ciphertext as a ...
poncho's user avatar
  • 148k
2 votes

How does a Padding Oracle Attack work in practice?

One protocol that is vulnerable all by itself is XML-enc, where enc of course means encryption. The earlier versions do not have any support for authenticated encryption, defaulting to CBC with PKCS#...
Maarten Bodewes's user avatar
  • 93.1k
2 votes

Creating own ciphertext after a padding oracle attack?

You should be able to generate a ciphertext for any given plaintext using a padding oracle attack if you are using CBC mode. You'll need to be able to modify the IV though for it to fully work. This ...
SztupY's user avatar
  • 131

Only top scored, non community-wiki answers of a minimum length are eligible