Security Flaws Induced by CBC Padding - Applications to SSL, IPSEC, WTLS

By Serge Vaudenay. International Conference on the Theory and Application of Cryptographic Techniques, 2002

381 citations recorded by the source corpus.

In many standards, e.g. SSL/TLS, IPSEC, WTLS, messages are first pre-formatted, then encrypted in CBC mode with a block cipher. Decryption needs to check if the format is valid. Validity of the format is easily leaked from communication protocols in a chosen ciphertext attack since the receiver usually sends an acknowledgment or an error message. This is a side channel.In this paper we show various ways to perform an efficient side channel attack. We discuss potential applications, extensions to other padding schemes and various ways to fix the problem.

Subfields: Artificial Intelligence, Computer Networks and Communications, Electrical and Electronic Engineering

View Paper: https://www.semanticscholar.org/paper/b6f5251a67c5cf8539c0213c387a583cdcefd493

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Electrical and Electronic Engineering

Citations in the corpus

Modern Cryptography: Theory and Practice (2003, methodology): “The timing analysis attack utilizes Vaudenay's "bomb oracle attack" on the standard CBC padding scheme [294] which we have studied in §7.”
OCB: a block-cipher mode of operation for efficient authenticated encryption (2001, positive): “This may be changing, as it becomes clear how damaging and widespread side-channel and chosen-ciphertext attacks can be [Vaudenay 2002; Black and Urtubia 2002].”
Lucky Thirteen: Breaking the TLS and DTLS Record Protocols (2013, background): “The other major line of attacks against the TLS Record Protocol comprises [37, 6, 26, 28, 1] and relates to how the padding that is required in MEE-TLS-CBC is handled during decryption.”
A Messy State of the Union: Taming the Composite State Machines of TLS (2015, methodology): “For these reasons, we have developed FLEXTLS, a tool for scripting and prototyping TLS scenarios in F#.”
Introduction to Modern Cryptography, Second Edition (2014, neutral): “The padding-oracle attack we describe here originated in the work of Vaudenay [171].”
Stack Overflow Considered Harmful? The Impact of Copy&Paste on Android Application Security (2017, methodology): “1 [19], [12], [20], [21] Cipher DHE RSA, ECDHE RC4,3DES, Suite AES>=128, GCM AES-CBC SHA>=256 [12] MD5, MD2 [12], [22] OnReceivedcancel proceed SSLError”
A survey on service function chaining (2016, background): “IPSec and TLS [116-118] mechanisms which are deployed to protect the links between two communication entities in SDN, may be used to protect the new interfaces introduced by NFV scenarios.”