Return to Question

Imagine that an attacker knows:

• A correct ciphertext.
• The algorithm: AES-256-CBC.
• The implementation: openssl CLI.
• The IV.

But does not know the key (let's assume the key was chosen in a sane way and is not derived, but full 256-bit). Also, this is the only ciphertext associated with this key.

There is no server. Is this enough to be vulnerable to the padding oracle attack? Meaning: can an attacker get the plaintext?

Imagine that an attacker knows:

• A correct ciphertext.
• The algorithm: AES-256-CBC.
• The implementation: openssl CLI.
• The IV.
• The HMAC-SHA-256 of the ciphertext.

But does not know the key (let's assume the key was chosen in a sane way and is not derived, but full 256-bit). Also, this is the only ciphertext associated with this key.

There is no server. Is this enough to be vulnerable to the padding oracle attack? Meaning: can an attacker get the plaintext?

Imagine that an attacker knows:

• A correct ciphertext.
• The algorithm: AES-256-CBC.
• The implementation: openssl CLI.
• The IV.

But does not know the key (let's assume the key was chosen in a sane way and is not derived, but full 256-bit).

There is no server. Is this enough to be vulnerable to the padding oracle attack? Meaning: can an attacker get the plaintext?

Imagine that an attacker knows:

• A correct ciphertext.
• The algorithm: AES-256-CBC.
• The implementation: openssl CLI.
• The IV.

But does not know the key (let's assume the key was chosen in a sane way and is not derived, but full 256-bit). Also, this is the only ciphertext associated with this key.

There is no server. Is this enough to be vulnerable to the padding oracle attack? Meaning: can an attacker get the plaintext?

Imagine that an attacker knows:

• A correct ciphertext.
• The algorithm: AES-256-CBC.
• The implementation: openssl CLI.

There is no server. Is this enough to be vulnerable to the padding oracle attack? Meaning: can an attacker get the plaintext?

Imagine that an attacker knows:

• A correct ciphertext.
• The algorithm: AES-256-CBC.
• The implementation: openssl CLI.
• The IV.

But does not know the key (let's assume the key was chosen in a sane way and is not derived, but full 256-bit).

There is no server. Is this enough to be vulnerable to the padding oracle attack? Meaning: can an attacker get the plaintext?