Is this usage of AES-CBC dangerous

Question

Imagine that an attacker knows:

• A correct ciphertext.
• The algorithm: AES-256-CBC.
• The implementation: openssl CLI.
• The IV.
• The HMAC-SHA-256 of the ciphertext.

But does not know the key (let's assume the key was chosen in a sane way and is not derived, but full 256-bit). Also, this is the only ciphertext associated with this key.

There is no server. Is this enough to be vulnerable to the padding oracle attack? Meaning: can an attacker get the plaintext?

Answer 1

A "padding oracle" is an entity (usually some sort of server) that will decrypt an arbitrary message, verify whether the padding is correct, and return this information to the (arbitrary) submitter of the message. If there's no such entity in your scheme, you cannot have a padding oracle attack, as there is no padding oracle to use for the attack.

Other relevant points:

• You don't specify a padding scheme that you're using. In practice the openssl command will use PKCS#5, which is a padding scheme that can be used to detect trivial tampering with the ciphertext (though it is not reliable at this), and is therefore applicable for a padding oracle attack, but other padding schemes may not have this property in which case a padding oracle couldn't even exist.
• You mention an HMAC, but not how it is used. You say it's the HMAC of the ciphertext, which means the verification must also be performed against the ciphertext. In practice, this almost always means that the verification is performed before decryption. Since the HMAC will fail to verify, hopefully the ciphertext processing would halt before getting to decryption (which comes before you can check padding). In such a scenario, even if you had a padding oracle a modified message would never reach it, because it would fail at the HMAC check. (Note that HMACs of the plaintext, which of course cannot be verified until after decryption, do not have this property, are much more likely to be vulnerable to a padding oracle attack).