Padding oracle attack
Description
This application may be vulnerable to a Padding Oracle Attack, a cryptographic side-channel vulnerability affecting CBC-mode encryption with PKCS#5/PKCS#7 padding. The vulnerability occurs when an application reveals whether decrypted ciphertext has valid or invalid padding through error messages, response times, or HTTP status codes. An attacker can exploit these subtle differences to decrypt encrypted data byte-by-byte without possessing the encryption key, effectively breaking the confidentiality of the encrypted communication.
Remediation
Implement the following measures to prevent padding oracle attacks:
1. Use Authenticated Encryption: Replace CBC-mode encryption with authenticated encryption modes such as GCM (Galois/Counter Mode) or use encrypt-then-MAC constructions. This prevents tampering and eliminates padding oracle vulnerabilities.
2. Implement Uniform Error Handling: Ensure that all decryption errors (invalid padding, MAC verification failures, etc.) return identical error messages and take the same amount of time to process. Never distinguish between padding errors and other decryption failures in responses.
3. Apply Constant-Time Operations: Use constant-time comparison functions and ensure decryption operations complete in consistent time regardless of padding validity.
4. Validate MAC Before Decryption: If using encrypt-then-MAC, verify the MAC before attempting decryption and reject invalid messages immediately with generic error responses.
Example of uniform error handling:
try {
byte[] decrypted = cipher.doFinal(ciphertext);
// Process decrypted data
} catch (BadPaddingException | IllegalBlockSizeException e) {
// Log error internally without details
logger.warn("Decryption failed");
// Return generic error to client
throw new SecurityException("Invalid request");
}5. Consider Modern Alternatives: Migrate to modern cryptographic libraries and protocols (such as TLS 1.3, libsodium, or NaCl) that provide secure defaults and built-in protection against padding oracle attacks.