4 ms·
TLS does CBC wrong: it authenticates the plaintext and then encrypts the plaintext and MAC. Since CBC mode needs to pad its input, this means that the padding
by agl 14y ago
TLS does CBC wrong: it authenticates the plaintext and then encrypts the plaintext and MAC.
Since CBC mode needs to pad its input, this means that the padding is outside of the authentication.
So, when decrypting, the padding has to be removed and then the MAC can be checked. But the number of blocks hashed in the MAC depends on the padding. So the attacker can setup the padding such that a valid padding means that it's removed and one less hash block is calculated. An invalid padding isn't removed and the MAC takes one more hash-block worth of time.
Thus the attacker can tell whether a padding was valid and that's sufficient to completely break TLS.
- Bootvis 14y agoHow is it sufficient to know the padding to break TLS? I thought that if you know the padding, you only know the message length.
- caf 14y agoThe attacker has an unknown plaintext byte P, and due to the way CBC mode works (together with the timing attack), is able to test if (P xor X) is a valid padding byte with X chosen by the attacker. Once the attacker finds an X that makes a valid padding byte, she can trivially determine P.