I read the Google paper about POODLE vulnerability (https://www.openssl.org/~bodo/ssl-poodle.pdf) and a lot of other articles.

Each paper/article wrote about that you have to try it in average 256 times to get the next byte in plaintext.

Currently my understanding is that I take a block of my encrypted data (located somewhere in the middle of all blocks) and copy it over the last block which contains the padding. I also understand that with some assumptions it is possible for a hacker to get the whole padding in this final block. And I understand how to calculate the last byte of the copied block if the MAC check succeeds.

However, I don't understand why the MAC check sometimes fails and sometimes not with the same copied encrypted block.

So I have following questions:

  1. Why is the plaintext of the last block (this means for the last byte too) not always the same if I take the same encrypted block? Is this cause of the initial vector I need to get the plaintext?

  2. Why the probability is exactly 1/256?

  • 1) You don't use the same encrypted block - you deliberately alter one byte of it. 2) You are tweaking the single plaintext byte essentially at random, and it needs to match the padding exactly - so there's a 1 in 256 chance of you being right. – paj28 Jun 5 '16 at 20:23

It is the job of an Initialization Vector to cause the same message to have a different encrypted value when encrypted with the same key. An IV is essentially a nonce used to salt a message.

As for why 1/256, that is the maximum possible values in a byte. A byte is a number that can range from 0 to 255. Including 0, that is 256 values. So a 1 in 256 chance of getting the correct next value of a byte, is the same as if randomly guessing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.