Assume an attacker has your CBC-encrypted file and the code that was used to generate it. Also that the file has a MAC at the end. Will the following attack work?
- Strip off the MAC from the end of the file. You know how many bytes it was.
- The last byte or bytes (you know how many, see above) is now the padding.
- Do a Vaudenay attack on that. You know the padding scheme.
- Recover the bulk of the message without knowing the key.
If this works, doesn't this mean that CBC with padding is dead? What have I missed?