CBC padding oracles and distinguishing error channels

Mechanism

A padding oracle reveals whether decrypted plaintext has syntactically valid padding. In CBC, modifying the preceding ciphertext block changes the next plaintext block predictably. Repeated queries can recover intermediate decryption bytes one position at a time. The oracle may be a status, exception, response size, or stable timing difference.

Practical method

First distinguish padding failure from later parsing or authentication failure. Work backward from the last byte with controlled padding lengths and preserve already solved positions. Use confirmation queries to reject accidental valid padding. Recover an intermediate block before deriving plaintext with the original previous ciphertext block.

P_i = D_K(C_i) XOR C_(i-1)
chosen C_(i-1) changes P_i without knowing K

Interpreting evidence

A reliable oracle classifies repeated control requests consistently. Log each candidate and its confirmation. The first block requires control of the IV or another way to emulate the preceding block.

Pitfalls and limits

Valid original padding can create false positives. Rate limiting and asynchronous timing invalidate simplistic classification. Encrypt-then-MAC with verified integrity before decryption removes this oracle when implemented correctly.