Padding oracle attack explained

In cryptography, a padding oracle attack is an attack which uses the padding validation of a cryptographic message to decrypt the ciphertext. In cryptography, variable-length plaintext messages often have to be padded (expanded) to be compatible with the underlying cryptographic primitive. The attack relies on having a "padding oracle" who freely responds to queries about whether a message is correctly padded or not. The information could be directly given, or leaked through a side-channel.

The earliest well-known attack that uses a padding oracle is Bleichenbacher's attack of 1998, which attacks RSA with PKCS #1 v1.5 padding. The term "padding oracle" appeared in literature in 2002,^[1] after Serge Vaudenay's attack on the CBC mode decryption used within symmetric block ciphers. Variants of both attacks continue to find success more than one decade after their original publication.^{[2] [3]}

Asymmetric cryptography

In 1998, Daniel Bleichenbacher published a seminal paper on what became known as Bleichenbacher's attack (also known as "million message attack"). The attack uses a padding oracle against RSA with PKCS #1 v1.5 padding, but it does not include the term. Later authors have classified his attack as a padding oracle attack.^[4]

Manger (2001) reports an attack on the replacement for PKCS #1 v1.5 padding, PKCS #1 v2.0 "OAEP".^[5]

Symmetric cryptography

In symmetric cryptography, the padding oracle attack can be applied to the CBC mode of operation. Leaked data on padding validity can allow attackers to decrypt (and sometimes encrypt) messages through the oracle using the oracle's key, without knowing the encryption key.

Compared to Bleichenbacher's attack on RSA with PKCS #1 v1.5, Vaudenay's attack on CBC is much more efficient.^[4] Both attacks target cryptosystems commonly-used for the time: CBC is the original mode used in Secure Sockets Layer (SSL) and had continued to be supported in TLS.^[2]

A number of mitigations have been performed to prevent the decryption software from acting as an oracle, but newer attacks based on timing have repeatedly revived this oracle. TLS 1.2 introduces a number of authenticated encryption with additional data modes that do not rely on CBC.^[2]

Padding oracle attack on CBC encryption

The standard implementation of CBC decryption in block ciphers is to decrypt all ciphertext blocks, validate the padding, remove the PKCS7 padding, and return the message's plaintext.If the server returns an "invalid padding" error instead of a generic "decryption failed" error, the attacker can use the server as a padding oracle to decrypt (and sometimes encrypt) messages.

The mathematical formula for CBC decryption is

P _{i} = D _{K(C} _{i)} ⊕ C _{i-1} , C _{0} = IV.

As depicted above, CBC decryption XORs each plaintext block with the previous block.As a result, a single-byte modification in block

C _{1} will make a corresponding change to a single byte in P _{2} .

Suppose the attacker has two ciphertext blocks

C _{1,} C _{2} and wants to decrypt the second block to get plaintext P _{2} .The attacker changes the last byte of C _{1} (creating C _{1'} ) and sends (IV,C _{1',C} _{2)} to the server.The server then returns whether or not the padding of the last decrypted block (P _{2'} ) is correct (a valid PKCS#7 padding).If the padding is correct, the attacker now knows that the last byte of D _{K(C} _{2)} ⊕ C _{1'} is 0x01 , the last two bytes are 0x02, the last three bytes are 0x03, …, or the last eight bytes are 0x08. The attacker can modify the second-last byte (flip any bit) to ensure that the last byte is 0x01. (Alternatively, the attacker can flip earlier bytes and binary search for the position to identify the padding. For example, if modifying the third-last byte is correct, but modifying the second-last byte is incorrect, then the last two bytes are known to be 0x02, allowing both of them to be decrypted.) Therefore, the last byte of D _{K(C} _{2)} equals C _{1'} ⊕ 0x01 .If the padding is incorrect, the attacker can change the last byte of C _{1'} to the next possible value.At most, the attacker will need to make 256 attempts to find the last byte of P _{2} , 255 attempts for every possible byte (256 possible, minus one by pigeonhole principle), plus one additional attempt to eliminate an ambiguous padding.

After determining the last byte of

P _{2} , the attacker can use the same technique to obtain the second-to-last byte of P _{2} .The attacker sets the last byte of P _{2} to 0x02 by setting the last byte of C _{1} to D _{K(C} _{2)} ⊕ 0x02 .The attacker then uses the same approach described above, this time modifying the second-to-last byte until the padding is correct (0x02, 0x02).

If a block consists of 128 bits (AES, for example), which is 16 bytes, the attacker will obtain plaintext

P _{2} in no more than 256⋅16 = 4096 attempts. This is significantly faster than the 2 ^{128} attempts required to bruteforce a 128-bit key.

Encrypting messages with Padding oracle attack (CBC-R)

CBC-R^[6] turns a decryption oracle into an encryption oracle, and is primarily demonstrated against padding oracles.

Using padding oracle attack CBC-R can craft an initialization vector and ciphertext block for any plaintext:

• decrypt any ciphertext P_i = PODecrypt(C_i) XOR C_i−1,
• select previous cipherblock C_x−1 freely,
• produce valid ciphertext/plaintext pair C_x-1 = P_x XOR PODecrypt(C_i).

To generate a ciphertext that is N blocks long, attacker must perform N numbers of padding oracle attacks. These attacks are chained together so that proper plaintext is constructed in reverse order, from end of message (C_N) to beginning message (C₀, IV). In each step, padding oracle attack is used to construct the IV to the previous chosen ciphertext.

The CBC-R attack will not work against an encryption scheme that authenticates ciphertext (using a message authentication code or similar) before decrypting.

Attacks using padding oracles

The original attack against CBC was published in 2002 by Serge Vaudenay.^[7] Concrete instantiations of the attack were later realised against SSL^[8] and IPSec.^{[9] [10]} It was also applied to several web frameworks, including JavaServer Faces, Ruby on Rails^[11] and ASP.NET^{[12] [13] [14]} as well as other software, such as the Steam gaming client.^[15] In 2012 it was shown to be effective against PKCS 11 cryptographic tokens.^[4]

While these earlier attacks were fixed by most TLS implementors following its public announcement, a new variant, the Lucky Thirteen attack, published in 2013, used a timing side-channel to re-open the vulnerability even in implementations that had previously been fixed. As of early 2014, the attack is no longer considered a threat in real-life operation, though it is still workable in theory (see signal-to-noise ratio) against a certain class of machines., the most active area of development for attacks upon cryptographic protocols used to secure Internet traffic are downgrade attack, such as Logjam^[16] and Export RSA/FREAK^[17] attacks, which trick clients into using less-secure cryptographic operations provided for compatibility with legacy clients when more secure ones are available. An attack called POODLE^[18] (late 2014) combines both a downgrade attack (to SSL 3.0) with a padding oracle attack on the older, insecure protocol to enable compromise of the transmitted data. In May 2016 it has been revealed in that the fix against Lucky Thirteen in OpenSSL introduced another timing-based padding oracle.

Notes and References

1. Side-Channel Attacks on Symmetric Encryption Schemes: The Case for Authenticated Encryption. 2002 . USENET Security '02. John. Black. Hector. Urtubia.
2. Web site: Sullivan . Nick . Padding oracles and the decline of CBC-mode cipher suites . The Cloudflare Blog . en . 12 February 2016.
3. Web site: ROBOT attack: Return Of Bleichenbacher's Oracle Threat . Hanno Böck . Juraj Somorovsky . Craig Young . February 27, 2018 .
4. Efficient Padding Oracle Attacks on Cryptographic Hardware. Romain Bardou . Riccardo Focardi . Yusuke Kawamoto . Lorenzo Simionato . Graham Steel . Joe-Kai Tsay. Rr-7944. INRIA. 2012. 19. report.
5. Web site: Manger. James. 2001. A Chosen Ciphertext Attack on RSA Optimal Asymmetric Encryption Padding (OAEP) as Standardized in PKCS #1 v2.0. Telstra Research Laboratories.
6. Juliano Rizzo . Thai Duong . 2010-05-25 . Practical Padding Oracle Attacks . USENIX WOOT 2010 .
7. Serge Vaudenay . 2002 . Security Flaws Induced by CBC Padding Applications to SSL, IPSEC, WTLS... . EUROCRYPT 2002 . Similar attack model was used by Bleichenbacher against PKCS#1 v1.5 [5] and by Manger against PKCS#1 v2.0 [13]. This paper shows that similar attacks are feasible in the symmetric key world..
8. .
9. .
10. .
11. Juliano Rizzo . Thai Duong . 2010-05-25 . Practical Padding Oracle Attacks . USENIX WOOT 2010 .
12. Thai Duong . Juliano Rizzo . 2011 . Cryptography in the Web: The Case of Cryptographic Design Flaws in ASP.NET . IEEE Symposium on Security and Privacy 2011 .
13. News: Dennis Fisher . 2010-09-13 . 'Padding Oracle' Crypto Attack Affects Millions of ASP.NET Apps . Threat Post. dead . https://web.archive.org/web/20101013200734/http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310 . 13 October 2010.
14. Web site: Vlad Azarkhin . 2010-09-19 . "Padding Oracle" ASP.NET Vulnerability Explanation . 11 October 2010 . https://web.archive.org/web/20101023090715/http://blogs.microsoft.co.il/blogs/linqed/archive/2010/09/19/padding-oracle-asp-net-vulnerability-explanation.aspx . 23 October 2010 . dead .
15. Web site: Breaking Steam Client Cryptography. Steam Database. 2016-05-01.
16. . For further information see https://www.weakdh.org .
17. Web site: Matthew Green . 2015-03-03 . Attack of the week: FREAK (or 'factoring the NSA for fun and profit') .

    see https://www.freakattack.com for more information.

18. Web site: Matthew Green . 2014-10-14 . Attack of the week: POODLE .

    for further information, see https://www.poodle.io