I'm having some trouble understanding the methodology for a crypto exercise I'm doing. The goal of the exercise is to recover an encrypted secret string through a chosen key attack on AES in ECB mode.

I have an oracle function that takes a string as input, appends the secret string to it, and returns the AES-ECB-128 encrypted string for it, using a static, randomly-generated key.

oracle("text goes here!!") -> AES.encrypt("text goes here!!somesecretsomesecret", "staticrandomkey!")

I understand how to get the plaintext for the secret phrase using the method described here, and have been successful at recovering 16-byte secret strings.

What I don't understand is, how can that method be applied to secret strings longer than 16 bytes? Unless I'm missing something obvious, it only works for recovering the first block of an appended secret.

I'm having some trouble understanding the methodology for a crypto exercise I'm doing. The goal of the exercise is to recover an encrypted secret string through a chosen key attack on AES in ECB mode.

I have an oracle function that takes a string as input, appends the secret string to it, and returns the AES-ECB-128 encrypted string for it, using a static, randomly-generated key.

oracle("text goes here!!") -> AES.encrypt("text goes here!!somesecretsomesecret", "staticrandomkey!")

I understand how to get the plaintext for the secret phrase using the method described here, and have been successful at recovering 16-byte secret strings.

What I don't understand is, how can that method be applied to secret strings longer than 16 bytes? Unless I'm missing something obvious, it only works for recovering the first block of an appended secret.