Security Glossary

Padding Oracle Attack

A cryptographic attack exploiting information leaked through error messages about padding validity, enabling decryption without knowing the key.

Padding Oracle Attack exploits applications that reveal whether decrypted data has valid padding. By observing different error responses, attackers can decrypt ciphertext byte-by-byte without knowing the encryption key.

How It Works

Block ciphers in CBC mode require padding (usually PKCS#7) to fill incomplete blocks. If an application returns different errors for "invalid padding" vs "invalid data," attackers can use this oracle to decrypt any ciphertext.

Attack Process

// For each byte of ciphertext, starting from the last:
1. Modify the preceding ciphertext block
2. Send to server and observe response
3. "Invalid padding" = wrong guess
4. "Invalid data" or success = correct guess
5. XOR to derive plaintext byte
6. Repeat for all bytes

// Each byte requires up to 256 attempts
// Full block (16 bytes) = ~4096 requests max

Example Scenario

// Encrypted cookie
Cookie: session=base64(IV + ciphertext)

// Normal response
HTTP 200 OK

// Modified ciphertext - invalid padding
HTTP 500 "Decryption error"

// Modified ciphertext - valid padding, invalid data
HTTP 400 "Invalid session format"

// Different responses = padding oracle!

Real-World Examples

  • ASP.NET Padding Oracle (CVE-2010-3332)
  • Ruby on Rails session cookies
  • Java Server Faces ViewState

Prevention

  • Use authenticated encryption (AES-GCM) instead of CBC
  • Return identical errors for all decryption failures
  • Use HMAC to verify ciphertext integrity before decryption
  • Implement constant-time comparison

PentesterLab Exercises

See Also