Score:1

Cryptography particular block length valid message

ax flag

I am new at cryptography and start to learn some terms. I just saw an question in the book and didn't got a clue about this question. Could someone can explain me the answer of this question? Because all of the questions seems to be fine for me.

Assuming the block length is 8 bytes (L = 8) Which of the following is/are are valid coded messages?

  1. 0x01 FF 52 18 04 04 04 04
  2. 0x01 FF 04 04 04 04 04 04
  3. 0x09 09 09 09 09 09 09 09
  4. 0x01 02 03 04 05 06 07 08
  5. 0x01 02 03 04 05 06 07 01
Maarten Bodewes avatar
in flag
I presume that the context will indicate padding for CBC mode? Hint: look up PKCS#7 padding on Wikipedia. Note that this would have nothing to do with CBC-MAC, MAC uses a different padding called bit-padding.
MariaDb avatar
ax flag
It's about padding attacks ,PKCS#5 and padding context in CBC mode.
Maarten Bodewes avatar
in flag
https://crypto.stackexchange.com/q/9043/1172
MariaDb avatar
ax flag
I preassume that 0x01 FF 04 04 04 04 04 04 the value 04 following the last byte is not valid because it repeats 6 times. I0x09 09 09 09 09 09 09 09 , 09 is not valid because it is more than the block length. But I am not sure of that. The question is about PKCS#5 padding security
Maarten Bodewes avatar
in flag
No it is about that PKCS#5 and #7 padding are basically identical. Note that PKCS#7 padding is build in such way that the message may end with *any* byte, which is why it is always applied. It therefore ranges in the size 1..8 bytes for a 8 byte block cipher. What does that tell you?
Maarten Bodewes avatar
in flag
WRT tagging, CBC doesn't authenticate the plaintext, so you can still alter the ciphertext as an attacker. Only if you change the last block or parts of the first-to-last block **may** you get errors during unpadding. So CBC mode is certainly malleable, with or without padding.
MariaDb avatar
ax flag
PKCS #5 Decoding: Say the final byte of encoded data has value b. If b = 0 or b > L, then return error. If final b bytes of encoded data are not all equal to b, then return error. Strip off the final b bytes of the encoded data, and output what is left as the message. I just found this decoding algorithms in internet for PKCS#5. I tried to comment according to this article. I didn't find a solution in where I read the question
Maarten Bodewes avatar
in flag
With the above correct description, can you guess which ones are correct or not? I've numbered them...
MariaDb avatar
ax flag
I think that 2 and 3 are not correct. But I am not sure of that.
Maarten Bodewes avatar
in flag
As for 2: can you remember what I said about the message containing any value? There is also another option that violates " If final b bytes of encoded data are not all equal to b, then return error.".
MariaDb avatar
ax flag
So the 3 and 4 not correct but 2 is correct?
Maarten Bodewes avatar
in flag
Yep, you're there!
MariaDb avatar
ax flag
Gracias Dear Maarten :)
Maarten Bodewes avatar
in flag
I've added a wiki answer just for my fellow cryptographers to see that this question has been handled, kindly accept (or ask for clarification if anything is unclear, of course).
Score:1
in flag

The trick with PKCS#5 padding (or the nearly equivalent PKCS#7 padding) is that it ends with a byte that indicates the number of padding bytes that was added to the message. You'd add $1$ to $n$ bytes to the message, where $n$ is the block size (formally $n=8$ in PKCS#5, $n\le255$ in PKCS#7). The end result is a full block of plaintext so that it can be encrypted using ECB or (P)CBC, without resorting to ciphertext stealing.

To check the validity of the padded plaintext as prescribed by PKCS#5 (6.1.2 §5), first take the final byte value $v$ and check if it is in the range $1$ to $n$ inclusive. Then check if the $v-1$ bytes before that final byte also have this value $v$. During decryption those bytes would be removed leaving you with the message. That message may well end with one or more bytes with the same value.

Note that the above checks allow for padding oracle attacks, and thus should not be performed if the integrity of the ciphertext hasn't been established by the receiving party. If the plaintext size is known in advance, then the checks and unpadding can be skipped altogether. Alternatively, when and if it becomes necessary to remove the padding, we can take the last byte $v$, and remove the $((n-1+v)\bmod n)+1$ last bytes. When $n\ne8$ this deviates neither from PKCS#5 (since formally it applies to $n=8$ only) nor from PKCS#7 (since that leaves the padding removal unspecified). This avoids the padding oracle, but later tests of the plaintext can still be exploitable.

Beware that there is also a padding mode from the (withdrawn) ISO 10126 standard that allows for padding with a byte of any value before the final byte. Otherwise it is compatible with PKCS#5/7, including the alternative padding check of the above paragraph.

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.