Padding Oracle
Definition
An attack that uses an error-message distinction (or a timing distinction) between 'padding invalid' and 'authentication invalid' to recover plaintext from CBC-mode ciphertext without the key.
- Target mode
- CBC-mode block cipher
- Exploited signal
- Distinguishable padding-error vs authentication-error response
- Requires
- No knowledge of the encryption key
- Result
- Plaintext recovery via repeated queries
Common questions
Why does distinguishing error messages matter so much to this attack?+
The attacker sends modified ciphertext and observes whether the server reports a padding failure or a different kind of failure; that binary signal, repeated across many queries, lets the attacker decrypt one byte at a time without ever learning the key itself.
How do modern protocols defend against padding oracle attacks?+
Authenticated encryption modes that verify integrity before processing padding, and returning identical generic error responses regardless of failure type, remove the distinguishable signal the attack depends on.
Related terms
- Brute Force
- Exhaustive search over the key space. The benchmark every other attack must beat. AES-128 brute force is computationally infeasible on classical hardware;...
- Cryptanalysis
- The study of breaking cryptographic systems. Complement to cryptography. Goals include recovering the key, recovering the plaintext, or distinguishing a cipher's output...
- Diffie-Hellman
- Key exchange protocol by Diffie, Hellman and Merkle (1976) that lets two parties agree on a shared secret over a public channel....
- Perfect Forward Secrecy (PFS)
- Property of a key exchange where compromise of a long-term private key does not let the attacker decrypt past sessions. Achieved by...
- Post-Quantum Cryptography (PQC)
- Algorithms designed to resist attacks by sufficiently capable quantum computers. NIST standardised CRYSTALS-Kyber as ML-KEM and CRYSTALS-Dilithium as ML-DSA in 2024.
- Side-Channel Attack
- Attack that exploits information leaked by a correct implementation: timing, power consumption, electromagnetic emanation, cache state, acoustic noise. Independent of the algebra...