# Padding oracle attack – Wikipedia

Cryptography attack
In cryptanalysis, a padding oracle attack is an fire which uses the padding validation of a cryptanalytic message to decrypt the ciphertext. In cryptanalysis, variable-length plaintext messages often have to be padded ( expanded ) to be compatible with the underlying cryptanalytic primitive. The attack relies on having a “ pad prophet ” who freely responds to queries about whether a message is correctly padded or not. Padding oracle attacks are largely associated with CBC manner decoding used within jam ciphers. Padding modes for asymmetrical algorithms such as OAEP may besides be vulnerable to padding prophet attacks. [ 1 ]

## Symmetric cryptanalysis

In symmetrical cryptography, the padding oracle attack can be applied to the CBC mode of process, where the “ oracle “ ( normally a server ) leaks data about whether the embroider of an code message is correct or not. such data can allow attackers to decrypt ( and sometimes encrypt ) messages through the oracle using the oracle ‘s key, without knowing the encoding identify .

### Padding oracle attack on CBC encoding

The standard implementation of CBC decoding in obstruct ciphers is to decrypt all ciphertext blocks, validate the padding, remove the PKCS7 padding, and return the message ‘s plaintext. If the waiter returns an “ invalid embroider ” error rather of a generic “ decoding failed ” error, the attacker can use the server as a padding oracle to decrypt ( and sometimes encrypt ) messages. The mathematical convention for CBC decoding is

P i = D K ( C one ) ⊕ C i − 1, { \displaystyle P_ { i } =D_ { K } ( C_ { i } ) \oplus C_ { i-1 }, } C 0 = I V. { \displaystyle C_ { 0 } =IV. } As depicted above, CBC decoding XORs each plaintext obstruct with the previous obstruct. As a solution, a single-byte modification in forget C 1 { \displaystyle C_ { 1 } } will make a match change to a single byte in P 2 { \displaystyle P_ { 2 } } . Suppose the attacker has two ciphertext blocks C 1, C 2 { \displaystyle C_ { 1 }, C_ { 2 } } and wants to decrypt the second block to get plaintext P 2 { \displaystyle P_ { 2 } }. The attacker changes the last byte of C 1 { \displaystyle C_ { 1 } } ( creating C 1 ′ { \displaystyle C_ { 1 } ‘ } ) and sends ( I V, C 1 ′, C 2 ) { \displaystyle ( IV, C_ { 1 } ‘, C_ { 2 } ) } to the server. The waiter then returns whether or not the embroider of the last decode block ( P 2 ′ { \displaystyle P_ { 2 } ‘ } ) is adjust ( a valid PKCS # 7 embroider ). If the pad is correct, the attacker nowadays knows that the end byte of D K ( C 2 ) ⊕ C 1 ′ { \displaystyle D_ { K } ( C_ { 2 } ) \oplus C_ { 1 } ‘ } is 0 ten 01 { \displaystyle \mathrm { 0x01 } } , the stopping point two bytes are 0x02, the last three bytes are 0x03, …, or the last eight bytes are 0x08. The attacker can modify the second-last byte ( flip any bite ) to ensure that the last byte is 0x01. ( alternatively, the attacker can flip earlier bytes and binary star search for the position to identify the slog. For example, if modifying the third-last byte is discipline, but modifying the second-last byte is incorrect, then the last two bytes are known to be 0x02, allowing both of them to be decrypted. ) therefore, the last byte of D K ( C 2 ) { \displaystyle D_ { K } ( C_ { 2 } ) } equals C 1 ′ ⊕ 0 ten 01 { \displaystyle C_ { 1 } ‘\oplus \mathrm { 0x01 } } . If the slog is wrong, the attacker can change the last byte of C 1 ′ { \displaystyle C_ { 1 } ‘ } to the following possible value. At most, the attacker will need to make 256 attempts to find the last byte of P 2 { \displaystyle P_ { 2 } }, 255 attempts for every possible byte ( 256 possible, minus one by pigeonhole rationale ), plus one extra undertake to eliminate an ambiguous pad. [ 2 ] After determining the last byte of P 2 { \displaystyle P_ { 2 } }, the attacker can use the lapp technique to obtain the second-to-last byte of P 2 { \displaystyle P_ { 2 } }. The attacker sets the last byte of P 2 { \displaystyle P_ { 2 } } to 0 x 02 { \displaystyle \mathrm { 0x02 } } by setting the last byte of C 1 { \displaystyle C_ { 1 } } to D K ( C 2 ) ⊕ 0 ten 02 { \displaystyle D_ { K } ( C_ { 2 } ) \oplus \mathrm { 0x02 } } . The attacker then uses the lapp approach described above, this time modifying the second-to-last byte until the pad is right ( 0x02, 0x02 ).

If a block consists of 128 bits ( AES, for exemplar ), which is 16 bytes, the attacker will obtain plaintext P 2 { \displaystyle P_ { 2 } } in no more than 256⋅16 = 4096 attempts. This is significantly faster than the 2 128 { \displaystyle 2^ { 128 } } attempts required to bruteforce a 128-bit key .

### Encrypting messages with Padding prophet attack ( CBC-R )

CBC-R [ 3 ] turns a decoding prophet into an encoding prophet, and is chiefly demonstrated against padding oracles. Using padding oracle attack CBC-R can craft an low-level formatting vector and ciphertext auction block for any plaintext :

• decrypt any ciphertext Pi = PODecrypt( Ci ) XOR Ci−1,
• select previous cipherblock Cx−1 freely,
• produce valid ciphertext/plaintext pair Cx-1 = Px XOR PODecrypt( Ci ).

To generate a ciphertext that is N blocks hanker, attacker must perform N numbers of padding oracle attacks. These attacks are chained together so that proper plaintext is constructed in turn back order, from end of message ( CN ) to beginning message ( C0, IV ). In each footstep, padding prophet attack is used to construct the IV to the previous chosen ciphertext. The CBC-R attack will not work against an encoding scheme that authenticates ciphertext ( using a message authentication code or similar ) before decrypting .