Padding Oracle Attack - Decrypting First Block with Static IV

VitoCorleone

4/25/24, 9:47 AM

I'm trying to understand the exploitability of the padding oracle attack, which enables someone to decrypt and encrypt the contents without knowing the encryption key.

Can encrypted data with the first block, be decrypted by the app that relies on a static IV without knowing the IV?

I want to understand the padding oracle attack's exploitability, especially to decrypt the first block of data using static IV. The Rijndael algorithm and CBC mode with PKCS7 padding I am familiar with. Due to unknown IV, I am unable to decrypt the first block, though.

I can perform this attack (demo environment) against an implementation that relies on Rijndael algorithm with CBC mode and PKCS7 padding. I'm able to decrypt all the blocks except the first one, because of the IV that 'I don't know'.

This attack makes it also possible to encrypt data without knowing the key. Suppose that the IV is static. Should it be possible to encrypt contents including the first block in such a way, that could be decrypted by the application that relies on a certain static IV, even without me knowing that IV? Otherwise, if I have an originally encrypted string (whose first block relies on the static IV), can I reuse something from the first block that I can use or feed to my own encryption process to ensure that the first block can be decrypted by the application that relies on the static IV?

My questions.

Can encrypted data be created that the program is using a static IV to decode it even if I don't know the IV?

Can I use the first block of a string who uses a static IV in the encryption to decode the block?

Is this attack possible with Rustpad?

I have a lot to learn about encryption so bare with me please.

The tool I use to exploit this attack (decryption/encryption) is Rustpad.

Source : Padding oracle attack.

168

1 + 0

cbc

padding

Score:1

Crypto

mti2935

4/25/24, 2:58 PM

Can encrypted data with the first block, be decrypted by the app that relies on a static IV without knowing the IV?

No. To decrypt the first block of ciphertext, you must know the IV. See the diagram below (coped from Wikipedia) which shows how AES decryption works, in CBC mode:

Point (A) represents the first block of ciphertext, after being decrypted with AES using the key. Then, (A) is XOR'd with the IV (B), to produce the first block of plaintext (C). Without knowing the IV, the algorithm would have no way to produce the first block of plaintext. However, as you can see, the IV is only needed to produce the first block of plaintext - it is not used to produce the remaining blocks of plaintext.

As a related sidenote - this means that AES-CBC is susceptible to IV malleability. If the attacker knows the ciphertext and the key, and can control the IV, then he can carefully choose an IV to make the first block of ciphertext decrypt to a plaintext of his choice. See https://security.stackexchange.com/questions/217862/what-if-the-attacker-tamper-the-iv-used-in-the-block-cipher-cbc-mode for more info.

+ 2

fgrieu

4/25/24, 4:00 PM

Indeed, to decipher the first block one needs the IV, and with unknown random IV nothing can be deduced about the first plaintext block. However in the question the IV is constant, thus there may be ways to obtain the IV from other decryptions. One way would be to obtain a known plaintext/ciphertext pair and use $\mathsf{IV}=P_1\oplus D(C_1)$ (where $P_1$ is the first padded plaintext block and $C_1$ the first ciphertext block). Another way would be to use that with a single ciphertext block $C_1$, $\mathsf{IV}\oplus D(C_1)$ is checked for padding.

VitoCorleone

4/26/24, 8:14 AM

Thank you both for the clarification. This makes sense.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Padding Oracle Attack - Decrypting First Block with Static IV

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.