Imagine that an attacker knows:

  • A correct ciphertext.
  • The algorithm: AES-256-CBC.
  • The implementation: openssl CLI.
  • The IV.
  • The HMAC-SHA-256 of the ciphertext.

But does not know the key (let's assume the key was chosen in a sane way and is not derived, but full 256-bit). Also, this is the only ciphertext associated with this key.

There is no server. Is this enough to be vulnerable to the padding oracle attack? Meaning: can an attacker get the plaintext?

  • If there is no server, then who is your padding oracle?
    – David
    Apr 7, 2018 at 17:58
  • @David sorry, i was just confused after reading too many articles about it xD i see it now. if you write it as an answer, i'll accept it :)
    – ebvtrnog
    Apr 7, 2018 at 18:35

1 Answer 1


A "padding oracle" is an entity (usually some sort of server) that will decrypt an arbitrary message, verify whether the padding is correct, and return this information to the (arbitrary) submitter of the message. If there's no such entity in your scheme, you cannot have a padding oracle attack, as there is no padding oracle to use for the attack.

Other relevant points:

  • You don't specify a padding scheme that you're using. In practice the openssl command will use PKCS#5, which is a padding scheme that can be used to detect trivial tampering with the ciphertext (though it is not reliable at this), and is therefore applicable for a padding oracle attack, but other padding schemes may not have this property in which case a padding oracle couldn't even exist.
  • You mention an HMAC, but not how it is used. You say it's the HMAC of the ciphertext, which means the verification must also be performed against the ciphertext. In practice, this almost always means that the verification is performed before decryption. Since the HMAC will fail to verify, hopefully the ciphertext processing would halt before getting to decryption (which comes before you can check padding). In such a scenario, even if you had a padding oracle a modified message would never reach it, because it would fail at the HMAC check. (Note that HMACs of the plaintext, which of course cannot be verified until after decryption, do not have this property, are much more likely to be vulnerable to a padding oracle attack).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .