Padding oracle attack
|This article is outdated. (February 2014)|
In cryptography, a padding oracle attack is an attack which is performed on the padding of a cryptographic message. The plain text message often has to be padded (expanded) to be compatible with the underlying cryptographic primitive. Leakage of information about the padding may occur mainly during decryption of the ciphertext. Padding oracle attacks are mostly associated with ECB or CBC mode decryption used within block ciphers. Padding modes for asymmetric algorithms such as OAEP may also be vulnerable to padding oracle attacks.
In symmetric cryptography, the padding oracle attack can be applied to the CBC mode of operation, where the "oracle" (usually a server) leaks data about whether the padding of an encrypted message is correct or not. Such data can allow attackers to decrypt (and sometimes encrypt) messages through the oracle using the oracle's key, without knowing the encryption key.
Example of the attack on CBC encryption
Suppose the attacker has three ciphertext blocks and he wants to decrypt the second block (get plaintext ). He only knows that the very last block is padded correctly and the padding method is PKCS7, which means that the last block is padded with bytes each equals to n (for example: six bytes, each byte = 0x06).
CBC decryption works as follows: If the attacker changes the last byte of and sends to the server, it will affects the whole block (because of decryption avalanche effect) and the last byte of (because of XORing operation). Then the server checks the padding of the last decrypted block (which is ), and return the result: if the padding correct or not (this check is performed before the actual processing of the plaintext message).
Let be the last byte of . The attacker changes it as follows: , where is the guessed value of the last byte of . If were a shrewd guess (the exact value of 's last byte) the server will not raise the padding error (because the last byte of becomes equal 0x01, which is correct padding). In other case the sever will return the padding error code and the attacker will try the next value of . In the worst case he needs to make 255 attempts to find the right value of .
After he knows the last byte of , he continues to obtain the last but one byte of . He changes the last two bytes of : and . Now he tries to find the value , which results in correct padding (0x02,0x02). After no more than 255 guesses he will get it and proceed to and so on.
If any block consists of 128 bits (AES, for example), which is 16 bytes, the attacker will obtain plaintext in no more than 255⋅16 = 4080 attempts. This attack costs literally nothing and can be performed in a few seconds (depends on the server's speed).
Attacks using padding oracles
The original attack was published in 2002 by Serge Vaudenay. In 2010 the attack was applied to several web application frameworks, including JavaServer Faces, Ruby on Rails and ASP.NET. In 2012 it was shown to be effective against some hardened security devices.
While these earlier attacks were fixed by most TLS implementors following its public announcement, a new variant, the Lucky Thirteen attack, published in 2013, used a timing side-channel to re-open the vulnerability even in implementations that had previously been fixed. As of February 2013[update], TLS implementors are still working on developing fixes for their TLS code.
To prevent this attack, one could append an HMAC (Hash-based message authentication code) to the ciphertext. Without the key used to generate the HMAC, an attacker won't be able to produce valid ciphertexts. Since the HMAC is checked before the decryption stage, the attacker cannot do the required bit-fiddling and hence cannot discover the plaintext.
- Manger, James. "A Chosen Ciphertext Attack on RSA Optimal Asymmetric Encryption Padding (OAEP) as Standardized in PKCS #1 v2.0". Telstra Research Laboratories.
- Serge Vaudenay (2002). Security Flaws Induced by CBC Padding Applications to SSL, IPSEC, WTLS... EUROCRYPT 2002.
- Juliano Rizzo, Thai Duong (2010-05-25). Practical Padding Oracle Attacks. USENIX WOOT 2010.
- Thai Duong, Juliano Rizzo (2011). Cryptography in the Web: The Case of Cryptographic Design Flaws in ASP.NET. IEEE Symposium on Security and Privacy 2011.
- Dennis Fisher (2010-09-13). "'Padding Oracle' Crypto Attack Affects Millions of ASP.NET Apps". Threat Post.
- Vlad Azarkhin (2010-09-19). "“Padding Oracle” ASP.NET Vulnerability Explanation".
- Romain Bardou, Riccardo Focardi, Yusuke Kawamoto, Lorenzo Simionato, Graham Steel, Joe-Kai Tsay (2012), "Efficient Padding Oracle Attacks on Cryptographic Hardware"
|This cryptography-related article is a stub. You can help Wikipedia by expanding it.|