A padding oracle attack exploits a decryption service that reveals whether manipulated ciphertext produces valid padding. In CBC mode, changing one byte of a preceding ciphertext block changes the corresponding decrypted plaintext byte, allowing plaintext recovery without the encryption key. section 5.6 section 5.4.2
Equation 5.1
\[\begin{aligned} \begin{aligned} I_n &= \text{Decrypt}_{\text{Key}} (C_n) \\ P_n &= C_{n-1} \oplus I_n \end{aligned} \label{equation:padding-oracle-two-blocks} \end{aligned}\]CBC decryption makes the attack possible: the plaintext block equals the XOR of the preceding ciphertext block and the decrypted target block. section 5.4.2
The exploit targets PKCS#7 padding one byte at a time. It brute-forces the final byte of the preceding ciphertext block until the service accepts padding 0x01, then adjusts known trailing bytes to 0x02 0x02, continuing leftward. section 5.4.2
A typical recovery loop:
- Start with the final ciphertext block and work backward through the message. section 5.4.2
- Copy the preceding ciphertext block so trial modifications do not destroy the original. section 5.4.2
- For each padding length, preserve already recovered bytes while brute-forcing the next byte. section 5.4.2
- Use the accepted padding result and XOR equations to derive the target plaintext byte. section 5.4.2
Go exploit test
A test creates a padding-oracle server, requests an encrypted timestamp, calls RecoverPlaintextFromPaddingOracle, and logs the recovered value. The demonstrated run recovers “Fri Jun 9 14:39:01 PDT 2023.” section 5.4.2
The failure is not a direct break of the block cipher; it is information leaked by error behavior. Treat padding validity as secret, and generate a new IV for every CBC-encrypted message. section 5.6
