THE FOLD / CHEAT / THE EXPLOIT / THE PADDING ORACLE
THE PADDING ORACLE
one bit, returned politely, several thousand times
1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION
The cipher is not broken. The key is never touched. All the server does is answer, honestly, whether a message it could not decrypt had the wrong padding or the wrong contents — one bit, politely returned, several thousand times.
LIT verified live. against a 16-byte block, an oracle answering only valid or invalid recovers all 16 of 16 plaintext bytes in 2,364 queries — 147.8 per byte against a worst case of 256. That is 2,364 single-bit answers producing 128 bits of secret: the attack extracts about 1 bit of plaintext for every 18 bits it is told. The control is the whole argument — an oracle that returns the same answer regardless recovers 0 of 16, because the attack has no channel other than the difference between two replies.
LIT verified live. against a 16-byte block, an oracle answering only valid or invalid recovers all 16 of 16 plaintext bytes in 2,364 queries — 147.8 per byte against a worst case of 256. That is 2,364 single-bit answers producing 128 bits of secret: the attack extracts about 1 bit of plaintext for every 18 bits it is told. The control is the whole argument — an oracle that returns the same answer regardless recovers 0 of 16, because the attack has no channel other than the difference between two replies.
2 HOW IT WAS WEAVED · AI + HUMAN
Serge Vaudenay published this in 2002; it is the reason authenticated encryption exists and the reason MAC-then-encrypt was abandoned. It is textbook material and the sphere is built from the textbook — a toy permutation stands in for the cipher, because the attack never looks inside one.
AVAN (AI) counted the queries and the bits separately. The query count is the practical number and the bit count is the honest one: nothing is guessed, nothing is brute-forced, and the key is not attacked at all. What leaks is a distinction the server never intended to publish, and the arithmetic says how much a distinction is worth when you are allowed to ask for it repeatedly.
AVAN (AI) counted the queries and the bits separately. The query count is the practical number and the bit count is the honest one: nothing is guessed, nothing is brute-forced, and the key is not attacked at all. What leaks is a distinction the server never intended to publish, and the arithmetic says how much a distinction is worth when you are allowed to ask for it repeatedly.
3 ONE DIMENSION
2,364 yes-or-no answers. 128 bits of plaintext.
4 TWO DIMENSIONS · INTERACTIVE
Recover a byte at a time and watch the query count.
5 THREE DIMENSIONS + AVAN’S INVERSE
The green forward object.
AVAN’s addition (the inverse-companion): the forward reading is that error messages must not distinguish failure modes. The inverse is that secrecy was never a property of the ciphertext — it is a property of the whole system’s observable behaviour, and the encryption is only one term in it. Nothing here attacks the cipher; the leak is in the reply, and it would leak identically through a timing difference, a log line, or a slightly different length of error page. Read backwards, an implementation can be built entirely out of correct primitives and disclose everything, because what an attacker reads is not what you encrypted, it is everything you did differently.
LIT against a 16-byte block an oracle answering only valid or invalid recovers all 16 of 16 plaintext bytes in 2,364 queries - 147.8 per byte against a worst case of 256 - which is 2,364 single-bit answers producing 128 bits of secret, about 1 bit of plaintext for every 18 bits it is told; and the control is the whole argument, since an oracle that returns the same answer regardless recovers 0 of 16, because the attack has no channel other than the difference between two replies
FIG Serge Vaudenay published this in 2002; it is the reason authenticated encryption exists and the reason MAC-then-encrypt was abandoned. It is textbook material and the sphere is built from the textbook - a toy permutation stands in for the cipher, because the attack never looks inside one. AVAN counted the queries and the bits separately: the query count is the practical number and the bit count is the honest one, since nothing is guessed, nothing is brute-forced, and the key is not attacked at all. What leaks is a distinction the server never intended to publish.
FIG Serge Vaudenay published this in 2002; it is the reason authenticated encryption exists and the reason MAC-then-encrypt was abandoned. It is textbook material and the sphere is built from the textbook - a toy permutation stands in for the cipher, because the attack never looks inside one. AVAN counted the queries and the bits separately: the query count is the practical number and the bit count is the honest one, since nothing is guessed, nothing is brute-forced, and the key is not attacked at all. What leaks is a distinction the server never intended to publish.
◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE EXPLOIT · David Lee Wise (ROOT0), with AVAN