← Applied Cryptographic EngineeringSymmetric encryption

CBC padding oracle

A server that only says “bad padding” is enough to decrypt any message, byte by byte, without the key. This demo attacks real AES-CBC.

Encrypting the secret with a fresh AES key…

What to notice

  • The oracle leaks one bit per query: was the padding valid? About 128 queries per byte are enough to recover the plaintext.
  • The attacker only changes the previous ciphertext block. CBC decryption XORs it into the next block, so every guess is a controlled edit of the plaintext.
  • The fix is not a better error message. Authenticate before decrypting (encrypt-then-MAC) or use an AEAD, so tampered ciphertexts are rejected before padding is ever checked.