Chapter 10 - CBC Mode padding oracle

Question 1

What is a padding oracle attack and why does it work?

Answer 1

• Use a padding oracle, to determine if padding is correct
• Alter encrypted message
• Leaks one bit of information
• Repeat to decode message byte by byte

Question 2

What is CBC-Mode of encryption?

Answer 2

• Use IV as C0
• XOR data with previous ciphertext C-1
• Then encrypt

Question 3

How does the standard padding work in CBC mode?

Answer 3

• PKCS#5
• Fill bytes with number of bytes to be padded (e.g. 5 x 0x05)

Question 4

How can this attack be used in TLS 1.2?

Answer 4

• If “MAC then encrypt” is used
• Server decrypts, then checks padding, then check MAC
• In both cases a encrypted error message is sent back, but timing is different
• Use timing to determine if padding is correct