12 votes
Accepted

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

How does the new attack work at top level? In short They used BEAST-like Man in the Browser attack by using Cache-like attacks to perform a downgrade attack against any TLS connection to a ...
user avatar
  • 43.5k
11 votes
Accepted

Modes of operation that allow padding oracle attacks

In the padding oracle attack you have an oracle that only tells you whether a particular chosen ciphertext decrypts to a correctly padded plaintext. That oracle is used to build a last word oracle, ...
user avatar
  • 31.3k
11 votes

Does a cryptographic oracle have to be a server?

In Theory: No. How the Oracle is implemented or named is not important, only how it works. In Practice: Everything that leaks information can be abstracted as an Oracle. So it is also possible to use ...
user avatar
  • 1,537
8 votes
Accepted

How to verify the integrity of RSA encrypted messages?

With pure asymmetric encryption there is no way to ensure integrity and authenticity, since anyone who knows your public key can encrypt any message for you. For that you would need either a symmetric ...
user avatar
  • 31.3k
7 votes
Accepted

Why was Vaudenay's original padding oracle attack not exploitable on TLS 1.0?

It's a question of attack model. Vaudenay places himself in a model where the attacker is "outside", and trying to work out the password that a human user enters in a Web site (or another similar ...
user avatar
7 votes
Accepted

Is every block padded with AES?

Am I not understanding padding correctly? You're not understanding the padding attack correctly. Yes, only the last block is (typically) padded in CBC mode, however that doesn't mean that we can ...
user avatar
  • 134k
7 votes

During padding oracle attack (CBC), how is first byte of plaintext block is obtained?

Does PKCS#5 allow you to pad 16 bytes with 0x10 value? No, but that's because PKCS#5 only specifies padding for DES, and that has an 8 byte block size. Even PKCS#5 ...
user avatar
  • 85.9k
7 votes
Accepted

Are there actual consequences of padding oracle attacks?

I mean this is the server bug that it doesn't take a key in the first place and check if it's correct :) What do you mean with that? The key must be the right one, and the padding oracle attacks ...
user avatar
  • 85.9k
5 votes

Is this approach able to protect against padding oracle attacks?

You have to differentiate between it being theoretically OK and practically. Without fully checking, I can say that such an approach may be possible to fully prove. However, practically, it is almost ...
user avatar
5 votes

Modes of operation that allow padding oracle attacks

…are any other modes of operation vulnerable to padding oracle attacks? According to Vaudenay, it’s purely restricted to CBC. (Two years later, this was shown to be somewhat incorrecr.) A padding ...
user avatar
  • 17.4k
5 votes
Accepted

Is the Java function AES/CBC/PKCS5Padding vulnerable to padding oracle?

The problem with CBC mode is the padding. When there is a padding error, the server must respond to a message back to you so that you can send the message back again or encrypt the message from the ...
user avatar
  • 43.5k
5 votes

During padding oracle attack (CBC), how is first byte of plaintext block is obtained?

So, how do you reveal the first byte of a block, since you’re out of padding length? We are are not out of padding length. However, PKCS#5 (rfc 2898) is defined for 8-byte blocks i.e. for 64 block ...
user avatar
  • 43.5k
5 votes

Are there actual consequences of padding oracle attacks?

I am asking to know if this attack is just a one with no real world implications and no real data decryption capabilities(actual data) . The Lucky Thirteen attack is a real-world attack against TLS. ...
user avatar
4 votes
Accepted

Why is this a fix to Bleichenbacher's attack?

Why does this prevent the attack? Why doesn't the attacker just infer that the connection failed because of the bad padding? Why else could the connection fail? Well, the connection may fail because ...
user avatar
  • 134k
4 votes

Bleichenbacher 1998 "Million message attack" on RSA

I implemented this padding oracle attack some time ago in Python and remember this part being a bit confusing to wrap my head around, my code is as follows: ...
user avatar
  • 3,952
4 votes

How does a Padding Oracle Attack work in practice?

Here's a real-world example: A captcha service behaves as follows. First, it generates a distorted image of some known text $t$. It sends then image to a web browser, and waits for a response. It ...
user avatar
  • 10.8k
4 votes
Accepted

Is the 'Padding Oracle attack' deterministic?

These should both be valid paddings: ... ... ... 68 02 02 ... ... ... 68 02 01 But if this ambiguity comes up, we can distinguish between the two by modifying ...
user avatar
  • 867
4 votes

Is the 'Padding Oracle attack' deterministic?

I am afraid you didn't understand the algorithm of the padding oracle. I suggest studying the algorithm given at Vaudenay's original article on this. He is very concise in what he writes in the ...
user avatar
  • 41
4 votes

Choice of padding scheme to prevent CBC padding oracle attacks?

Padding oracle attacks are not the padding scheme's fault! They are not fixed by changing the padding! They are fixed by not leaking partial information about the result of decryption, or (preferably) ...
user avatar
  • 10.8k
4 votes

Padding Oracle Attack CBC Mode: If the set of characters of plaintext is known, then can you speed up the process

I will assume you generally understand the mechanics of the padding oracle attack. Say we have some ciphertext block $c_i = c_{i-1} \oplus E(k,m_i)$ and we want to find the last byte of $m_i$. Let $b$ ...
user avatar
  • 10.8k
4 votes

Does a cryptographic oracle have to be a server?

The word online means controlled by or connected to another computer or to a network (Oxford). The words query the oracle tells what you need and related to how your query is performed - online query ...
user avatar
  • 43.5k
3 votes

Attack RSA with PKCSv1.5 padding

First of all, this attack assumes that we have a decryption Oracle; that is, an Oracle that we can submit any ciphertext to (except for, apparently, the challenge ciphertext), and it will tell us that ...
user avatar
  • 134k
3 votes

Layman's description of the padding oracle attack

Quoting the answer here: Padding Oracle attacks are mainly a problem in cases, where e.g. an encrypted message is modified and send to a target. These attacks try to measure the difference when ...
user avatar
  • 19.2k
3 votes
Accepted

Clarification on the origin of `01` in this oracle padding attack?

Actually, we don't care about the amount of padding the original message had; we care whether the modified plaintext (that is, the result of the decryption of the modified ciphertext) has good padding ...
user avatar
  • 134k
3 votes

Why is this a fix to Bleichenbacher's attack?

Bleichenbacher's attack relies on being able to determine whether the padding was correct or not. The patch tries to ensure that the following two (previously distinguishable) cases look identical to ...
user avatar
  • 11.2k
3 votes

Why verify padding at all?

Your suggestion is essentially what ISO 10126 does, since there's no way to verify the random bytes that make up the rest of the padding. You could do the same with e.g. PKCS #7 padding, as you ...
user avatar
  • 31.3k
3 votes
Accepted

Why verify padding at all?

First of all, a more usual padding scheme would add 5 times the same byte 0x05 (in your example) so the check not just removes 5 bytes, but also checks that the 4 bytes before it have the same value. ...
user avatar
3 votes
Accepted

Weird size of data transmitted in SSLv3

You won't find the answer in the RFC; instead, here's what your SSL implementation is doing: when you send a single byte of data, it actually generates two records. The first record is empty; so it ...
user avatar
  • 134k
3 votes

Zero padded signatures in the Bleichenbacher attack

Why does RSA accept a 0x00 padded cube root as encoded signature? It is not correct to assume that a valid RSA signature always starts with a byte containing a few bits set to one. An RSA signature ...
user avatar
  • 85.9k
3 votes
Accepted

Security effects of the seed's length in OAEP

Let's start with the preliminaries. The basic scheme has encryption defined as follows: $$\mathcal{E}^{G, H}(x) = f(x \oplus G(r) || r \oplus H(x \oplus G(r)))$$ Some definitions: $f: \{0,1\}^k \...
user avatar
  • 3,952

Only top scored, non community-wiki answers of a minimum length are eligible