Applied Cryptography
A server receiving data encrypted in CBC mode returned different errors when the padding after decryption was incorrect and when the padding was correct but the check of the contents failed. Which of the following correctly describes this situation?
- AAn attacker can send modified ciphertexts and, using the difference in errors as a clue, may recover the plaintext byte by byte without knowing the key
- BThe difference in errors only reveals the length of the padding, so the contents of the plaintext themselves cannot leak unless the key leaks
- CChanging the key from AES-128 to AES-256 removes the risk of the plaintext being recovered from the difference in errors
Show answer and explanation
Answer: A. An attacker can send modified ciphertexts and, using the difference in errors as a clue, may recover the plaintext byte by byte without knowing the key
In CBC decryption, flipping a bit in one ciphertext block flips the bit at the same position in the decrypted result of the next block. By sending variants of the last byte of the preceding block and looking for a value judged as "correct padding", an attacker finds the last byte of the plaintext, and by repeating this reveals the plaintext one byte at a time. This is the padding oracle attack, in which differences in error types or response times act as the clue (the oracle). The basic countermeasures are to use authenticated encryption such as GCM, or to verify a MAC attached to the ciphertext first and uniformly reject tampered ciphertexts before decrypting them.
- A. Correct. Responses that only reveal whether the padding is valid are enough to recover the plaintext byte by byte.
- B. Knowing whether the padding is valid, combined with modifying the ciphertext, makes it possible to recover the plaintext itself.
- C. This attack does not recover the key; it uses the properties of CBC mode and the difference in errors, so changing the key length does not prevent it.