Can active attacks really decrypt a particular AES-256, CBC, PKCS#7 encrypted file?

Question

I recently found out that active attacks are a threat against AES-256, CBC mode, padded with PKCS#7 (the CBC mode in particular. I should supposedly change to EAX to guard against these attacks).

However, I'm confused about whether such attacks are effective against a particular encrypted local file that a cracker has obtained. (Indeed, if AES-256, CBC, padded with PKCS#7 is secure, a cracker's possession of such a file shouldn't have to be a case for concern in the first place).

In my internet browsing I found out two kinds of active attacks:

• Data tampering: Here, the cracker sends a modified ciphertext to some "system" (e.g. a web site). This could e.g. change a $1 bank transaction into a $1000 transaction.

I can't see how this would be useful against a local file, because there is no "system" to which we send any data. The cracker modifies the local ciphertext and that's it. He has nowhere to send it to.

• Actual decryption of the entire plain text: Here, the cracker will supposedly use something called a "padding oracle". This method relies on the "system" (e.g. a web site) to make a distinction between invalid ciphertext and a valid ciphertext (ciphertext that is decrypted into garbage). For instance, the invalid ciphertext can produce an exception, but the valid ciphertext can produce an "incorrect login".

Again, does this really pose a threat to local encrypted files? There is no "system", no login page etc., that tells us whether the ciphertext is "correct" or "incorrect".

All this confuses me. Are active attacks really useful against particular local encrypted files in CBC mode? In particular, is the "padding oracle" useful against encrypted files that used PKCS#7 padding?

Answer 1

A file which has been encrypted will be, presumably, decrypted later on (otherwise, what was the point of encrypting it as opposed to, say, deleting it ?). Active attacks of the chosen-ciphertext persuasion alter the encrypted data and try to gain information from what happens when the decryption occurs.

Padding oracle attacks are a specific kind of chosen-ciphertext attack, where the information which the attacker wishes to obtain is whether a correct padding was found upon decryption of his maliciously crafted file. Chosen-ciphertext attacks are not limited to games with the padding, but this kind of attack has been applied in practice against SSL servers.

---

Chosen-plaintext attacks are another kind of active attacks in which the attacker chooses part of the data which is to be encrypted. This occurs at another level in the whole system.

Active attacks, by definition, suppose that an "honest system" (one which knows a secret value that the attacker would like to obtain) acts upon some data which has been at least tampered with by the attacker. An honest system is necessary for active attacks, because there is of course nothing to be learned from a system which knows nothing. In the full life of data through an encryption system, there are two points where an "honest system" uses a secret element (the key) in conjunction with the input data: when encrypting and, later on, when decrypting. Both events are potential targets for active attackers.