CNS Lab 03 – Padding Oracle On AES-CBC-PKCS#7

Guarda su YouTube → 1:33:18 12 novembre 2022

Didattica

Descrizione

Third laboratory for the Computer Network Security (CNS) course at Tor Vergata during scholar year 2022-2023. In the laboratory we implemented the classical CBC padding oracle over padding scheme PKCS#7 that was introduced by Serge Vaudenay in his seminal paper “CBC Padding: Security Flaws in SSL, IPSEC, WTLS”. In order to understand how to implement the attack we have used a CTF-like challenge made up of a server TCP written in python. -------------------------------------------------- LECTURE MATERIAL: - https://teaching.leonardotamiano.xyz/cns/labs/lab_03/ -------------------------------------------------- TIMESTAMPS: 00:00:00 Introduction to CTFs 00:02:00 Description of the challenge 00:14:30 Review on AES-CBC 00:20:08 PKCS7 Padding 00:21:38 MAC-THEN-ENCRYPT scheme 00:27:40 Cryptographic oracles 00:32:20 Explaining the padding oracle attack 00:52:33 Implementing the attack

Commenti 6

I commenti vengono da YouTube e sono aggiornati periodicamente.

@YashNawghare-z4y 30 novembre 2023

what if we have the message and the iv?
1 risposta
1. @esadecimale Autore 30 novembre 2023
  
  assuming you can only use the cipher once and have gotten a static message, then no, you cannot easily obtain the key. You’d have to go through all the possibilities for each byte of the key, making it hard to brute force. If you can encrypt multiple plaintexts of your choosing, and if you are able to predict the IV of further messages, then you can mount a so-called BEAST attack then you can decrypt secret parts of the original message, however is not a trivial attack to implement in practice
@Pedro-jj7gp 12 giugno 2023 1

How did you make / set up your teaching website with the file tree and downloads?
3 risposte
1. @esadecimale Autore 12 giugno 2023
  
  Hi, the site is made with hugo, and I have picked a particular hugo theme called "the-roots-home". I have another video on the channel describing the setup I use to manage blogs (not only this one for teaching but also my other personal blog). Sadly it is only in italian. Its called "Come gestire un blog in un unico file", link here: https://www.youtube.com/watch?v=WQsghMNSymc
2. @Pedro-jj7gp 13 giugno 2023
  
  @esadecimale I know a little bit of italian, I'll give it a go. Thank you!
3. @esadecimale Autore 13 giugno 2023
  
  @Pedro-jj7gpthinking about it, the video is actually me reading a blog post, which is in english: https://blog.leonardotamiano.xyz/tech/how-i-manage-my-blog/ write a comment there for any issues