I recently found out that active attacks are a threat against AES-256, CBC mode, padded with PKCS#7 (the CBC mode in particular. I should supposedly change to EAX to guard against these attacks).

However, I'm confused about whether such attacks are effective against a particular encrypted local file that a cracker has obtained. (Indeed, if AES-256, CBC, padded with PKCS#7 is secure, a cracker's possession of such a file shouldn't have to be a case for concern in the first place).

In my internet browsing I found out two kinds of active attacks:

  • Data tampering: Here, the cracker sends a modified ciphertext to some "system" (e.g. a web site). This could e.g. change a $1 bank transaction into a $1000 transaction.

I can't see how this would be useful against a local file, because there is no "system" to which we send any data. The cracker modifies the local ciphertext and that's it. He has nowhere to send it to.

  • Actual decryption of the entire plain text: Here, the cracker will supposedly use something called a "padding oracle". This method relies on the "system" (e.g. a web site) to make a distinction between invalid ciphertext and a valid ciphertext (ciphertext that is decrypted into garbage). For instance, the invalid ciphertext can produce an exception, but the valid ciphertext can produce an "incorrect login".

Again, does this really pose a threat to local encrypted files? There is no "system", no login page etc., that tells us whether the ciphertext is "correct" or "incorrect".

All this confuses me. Are active attacks really useful against particular local encrypted files in CBC mode? In particular, is the "padding oracle" useful against encrypted files that used PKCS#7 padding?

  • 1
    While it might be hard to attack for local files, it's certainly possible with other uses. Why would you deliberately weaken your system and make assumptions about how it's used? Apart from a bit lower performance, authenticated encryption has few disadvantages, and gives the piece of mind that your crypto is secure against active attacks, instead of having to consider and dismiss each possible attack individually. – CodesInChaos Feb 28 '13 at 19:40

A file which has been encrypted will be, presumably, decrypted later on (otherwise, what was the point of encrypting it as opposed to, say, deleting it ?). Active attacks of the chosen-ciphertext persuasion alter the encrypted data and try to gain information from what happens when the decryption occurs.

Padding oracle attacks are a specific kind of chosen-ciphertext attack, where the information which the attacker wishes to obtain is whether a correct padding was found upon decryption of his maliciously crafted file. Chosen-ciphertext attacks are not limited to games with the padding, but this kind of attack has been applied in practice against SSL servers.

Chosen-plaintext attacks are another kind of active attacks in which the attacker chooses part of the data which is to be encrypted. This occurs at another level in the whole system.

Active attacks, by definition, suppose that an "honest system" (one which knows a secret value that the attacker would like to obtain) acts upon some data which has been at least tampered with by the attacker. An honest system is necessary for active attacks, because there is of course nothing to be learned from a system which knows nothing. In the full life of data through an encryption system, there are two points where an "honest system" uses a secret element (the key) in conjunction with the input data: when encrypting and, later on, when decrypting. Both events are potential targets for active attackers.

  • Do you think these concerns of active attacks against local CBC encrypted files are more theoretical than practical? Could you provide some information about the practicality of such attacks, how long time they could take, etc.? Would you urge everyone to dump CBC and switch ASAP to something like EAX? – user21203 Feb 28 '13 at 19:46
  • People who have the requisite knowledge to fiddle with cryptographic algorithms down to that level (without shooting off their own feet) already know that they need checked integrity almost whenever they need confidentiality (that encryption provides). EAX and GCM are good ways to get that; older methods entail combining encryption with HMAC, but it is hard to do it right (e.g. SSL got it slightly wrong and it has proved a recurrent source of trouble). – Thomas Pornin Feb 28 '13 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.