In cryptography, a padding oracle attack is an attack which uses the padding validation of a cryptographic message to decrypt the ciphertext. In cryptography, variable-length plaintext messages often have to be padded (expanded) to be compatible with the underlying cryptographic primitive. The attack relies on having a "padding oracle" who freely responds to queries about whether a message is correctly padded or not. Padding oracle attacks are mostly associated with CBC mode decryption used within block ciphers. Padding modes for asymmetric algorithms such as OAEP may also be vulnerable to padding oracle attacks.

## Symmetric cryptography

In symmetric cryptography, the padding oracle attack can be applied to the CBC mode of operation, where the "oracle" (usually a server) leaks data about whether the padding of an encrypted message is correct or not. Such data can allow attackers to decrypt (and sometimes encrypt) messages through the oracle using the oracle's key, without knowing the encryption key.

### Padding oracle attack on CBC encryption

The standard implementation of CBC decryption in block ciphers is to decrypt all ciphertext blocks, validate the padding, remove the PKCS7 padding, and return the message's plaintext. If the server returns an "invalid padding" error instead of a generic "decryption failed" error, the attacker can use the server as a padding oracle to decrypt (and sometimes encrypt) messages.

The mathematical formula for CBC decryption is

$P_{i}=D_{K}(C_{i})\oplus C_{i-1},$ $C_{0}=IV.$ As depicted above, CBC decryption XORs each plaintext block with the previous block. As a result, a single-byte modification in block $C_{1}$ will make a corresponding change to a single byte in $P_{2}$ .

Suppose the attacker has two ciphertext blocks $C_{1},C_{2}$ and wants to decrypt the second block to get plaintext $P_{2}$ . The attacker changes the last byte of $C_{1}$ (creating $C_{1}'$ ) and sends $(IV,C_{1}',C_{2})$ to the server. The server then returns whether or not the padding of the last decrypted block ($P_{2}'$ ) is correct (a valid PKCS#7 padding). If the padding is correct, the attacker now knows that the last byte of $D_{K}(C_{2})\oplus C_{1}'$ is $\mathrm {0x01}$ , the last two bytes are 0x02, the last three bytes are 0x03, …, or the last eight bytes are 0x08. The attacker can modify the second-last byte (flip any bit) to ensure that the last byte is 0x01. (Alternatively, the attacker can flip earlier bytes and binary search for the position to identify the padding. For example, if modifying the third-last byte is correct, but modifying the second-last byte is incorrect, then the last two bytes are known to be 0x02, allowing both of them to be decrypted.) Therefore, the last byte of $D_{K}(C_{2})$ equals $C_{1}'\oplus \mathrm {0x01}$ . If the padding is incorrect, the attacker can change the last byte of $C_{1}'$ to the next possible value. At most, the attacker will need to make 256 attempts to find the last byte of $P_{2}$ , 255 attempts for every possible byte (256 possible, minus one by pigeonhole principle), plus one additional attempt to eliminate an ambiguous padding.

After determining the last byte of $P_{2}$ , the attacker can use the same technique to obtain the second-to-last byte of $P_{2}$ . The attacker sets the last byte of $P_{2}$ to $\mathrm {0x02}$ by setting the last byte of $C_{1}$ to $D_{K}(C_{2})\oplus \mathrm {0x02}$ . The attacker then uses the same approach described above, this time modifying the second-to-last byte until the padding is correct (0x02, 0x02).

If a block consists of 128 bits (AES, for example), which is 16 bytes, the attacker will obtain plaintext $P_{2}$ in no more than 256⋅16 = 4096 attempts. This is significantly faster than the $2^{128}$ attempts required to bruteforce a 128-bit key.

### Encrypting messages with Padding oracle attack (CBC-R)

CBC-R turns a decryption oracle into an encryption oracle, and is primarily demonstrated against padding oracles.

Using padding oracle attack CBC-R can craft an initialization vector and ciphertext block for any plaintext:

• decrypt any ciphertext Pi = PODecrypt( Ci ) XOR Ci−1,
• select previous cipherblock Cx−1 freely,
• produce valid ciphertext/plaintext pair Cx-1 = Px XOR PODecrypt( Ci ).

To generate a ciphertext that is N blocks long, attacker must perform N numbers of padding oracle attacks. These attacks are chained together so that proper plaintext is constructed in reverse order, from end of message (CN) to beginning message (C0, IV). In each step, padding oracle attack is used to construct the IV to the previous chosen ciphertext.

The CBC-R attack will not work against an encryption scheme that authenticates ciphertext (using a message authentication code or similar) before decrypting.