I was reading the Here Come The ⊕ Ninjas document about the BEAST attack discovered by Thai Duong & Juliano Rizzo. There are two points I cannot understand.
At the section 5 - Application: Decrypting HTTPS Requests, they explain step by step to makes this attack possible.
I will be focus on Step 3 and Step 4:
(Reproduced as plain text here. A nicer LaTeX rendering is on page 7 of the paper.)
Let IV be the last ciphertext block that Mallory captures, e.g., IV is Cn after step 2. Mallory computes Pi = IV XOR C2 XOR Pguess, where Pguess = P/1.1\r\nW[i]. Mallory appends Pi to the existing request, e.g., Pi is appended to the request body (this is the last assumption.) Alice’s browser would compute Ci Ek(IV XOR Pi) and send Ci to server.
Mallory captures Ci. If Ci = C3, he knows that X is equal to W[i]. Otherwise he increases i and goes back to step 3.
Meaning that Mallory captures
C1 and compares the encrypted block
C3? Because IV is used to be XOR with
P1 so why do they speak about
Ci like it can be
Cn when it can only be
In fact this reflexion comes from this :
Pi is appended to the request body -> the request body of an HTTP request? There is no sense to put this in the request body! Meaning IV is only use with the
So what's the point of putting
Pi in the request body ?