Paper 2023/1790 Original: eprint.iacr.org/2023/1790 ↗
Compromising sensitive information through Padding Oracle and Known Plaintext attacks in Encrypt-then-TLS scenarios
Abstract
Let's consider a scenario where the server encrypts data using AES-CBC without authentication and then sends only the encrypted ciphertext through TLS (without IV). Then, having a padding oracle, we managed to recover the initialization vector and the sensitive data, doing a cybersecurity audit for a Chilean company.
Metadata
- Available format(s)
PDF- Category
- Attacks and cryptanalysis
- Publication info
- Preprint.
- History
- 2023-11-20: last updated
- 2023-11-20: published
- Short URL
- https://ia.cr/2023/1790
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2023/1790,
author = {Daniel Espinoza Figueroa},
title = {Compromising sensitive information through Padding Oracle and Known Plaintext attacks in Encrypt-then-TLS scenarios},
howpublished = {Cryptology {ePrint} Archive, Paper 2023/1790},
year = {2023},
url = {https://eprint.iacr.org/2023/1790}
}