%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% poa.tex
%  Padding Oracle Attacks, full version as example of latex macros for students
%
% last modified 2/14/2011, ristenpart
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\documentclass[11pt,twoside]{article}

\usepackage{latexsym,url,pst-node,pstricks}
\usepackage[dvips]{graphics}
%\usepackage[usenames]{color}
\usepackage{dsfont}
\usepackage[hmargin=1in,vmargin=1in]{geometry}

\newcommand{\procfont}[1]{\textbf{#1}}


\newcommand{\Initialize}{{\ensuremath{\mathbf{Initialize}}}}

\newcommand{\Finalize}{{\ensuremath{\mathbf{Finalize}}}}


\newcommand{\procedure}[1]{\underline{\procfont{procedure} {#1}}}
\newcommand{\procedurev}[1]{\underline{\procfont{procedure} {#1}}\smallskip}
\newcommand{\algorithm}[1]{\underline{\procfont{Alg} {#1}}}
\newcommand{\algorithmv}[1]{\underline{\procfont{Alg} {#1}}\smallskip}
\newcommand{\adversary}[1]{\underline{\procfont{adversary} {#1}}}
\newcommand{\adversaryv}[1]{\underline{\procfont{adversary} {#1}\smallskip}}
\newcommand{\Adversary}[1]{\procfont{Adversary} {#1}}
\newcommand{\subroutine}[1]{\underline{\procfont{subroutine} {#1}}}

\newcommand{\Return}{Return}

\newcommand{\ind}{\hspace*{10pt}}

\newcommand{\getsr}
  {{\:\stackrel{\raisebox{-2pt}{${\scriptscriptstyle \hspace{0.2em}\$}$}}
   {\leftarrow}\:}}


\def\true{\mathsf{true}}
\def\false{\mathsf{false}}

\newcommand{\figref}[1]{\mbox{Fig.~\ref{#1}}}
\newcommand{\probsym}{{\Pr}}

\newcommand{\Prob}[1]{\probsym\left[{#1}\right]}
\newcommand{\CondProb}[2]{\probsym\left[{#1}\left|\right.#2\right]}


\newcommand{\SE}{\mathcal{SE}}

\newcommand{\kg}{\cal{K}}
\newcommand{\concat}{\:\|\:}
\newcommand{\dec}{\ensuremath{\mathcal{D}}}

\newcommand{\dotdot}{{\:..\:}}
\newcommand{\LR}{\procfont{LR}}
\newcommand{\Encipher}{\procfont{E}}
\newcommand{\AEnc}{{\cal AE}}
\newcommand{\Enc}{\mathbf{Enc}}
\newcommand{\Dec}{\mathbf{Dec}}
\newcommand{\AD}{\mathit{AD}}
\newcommand{\ROR}{\mathrm{RoR}}
\newcommand{\SEM}{\mathrm{SEM}}
\newcommand{\numtostr}[2]{[ {#2} ]_{\raisebox{-1.1pt}{$\scriptscriptstyle #1$}}}
\newcommand{\strtonum}[1]{[#1]}
\newcommand{\DES}{\ensuremath{\mathsf{DES}}}
\newcommand{\AES}{{\ensuremath{\mathsf{AES}}}}
\newcommand{\enc}{\ensuremath{\mathcal{E}}}
\newcommand{\newenc}{\overline{{\cal E}}}
\newcommand{\decc}{{\cal D}}
\newcommand{\newdecc}{\overline{{\cal D}}}

\newcommand{\SYMscheme}{{\cal SE}}
\newcommand{\Colon}{{:\;\;}}
\newcommand{\IV}{IV}
\newcommand{\bits}{\{0,1\}}
\newcommand{\Pad}{\textnormal{Pad}}
\newcommand{\Unpad}{\textnormal{Unpad}}
\newcommand{\POA}{\textnormal{POA}}
\newcommand{\POATK}{\textnormal{POA}}
\newcommand{\CheckPad}{\procfont{CheckPad}}
\newcommand{\PTE}{{\cal PTE}}
\newcommand{\PTEenc}{{\PTE.\enc}}
\newcommand{\PTEdec}{{\PTE.\dec}}
\newcommand{\AdvPOA}[2]{\mathbf{Adv}^{\mathrm{poa}}_{#1}({#2})}
\newcommand{\Lastbyte}{\textnormal{LastByte}}
\newcommand{\FindOneByte}{\textnormal{FindOneByte}}
\newcommand{\fail}{\textnormal{fail}}

\newcommand{\mpage}[2]{\begin{minipage}{#1\textwidth} #2 \end{minipage}}
\newcommand{\fpage}[2]{\framebox{\begin{minipage}{#1\textwidth} #2 \end{minipage}}}


\newcommand{\hfpages}[3]{
		\begin{tabular}{cc}
		\framebox{\begin{minipage}{#1\textwidth} #2 \end{minipage}}
		&
		\framebox{\begin{minipage}{#1\textwidth} #3 \end{minipage}}
		\end{tabular}
	}
\newcommand{\hpagesnl}[3]{\begin{tabular}{cc}\begin{minipage}[t]{#1\textwidth} #2 \end{minipage} & \begin{minipage}[t]{#1\textwidth} #3 \end{minipage}\end{tabular}}
\newcommand{\hpagessnl}[4]{\begin{tabular}{cc}\begin{minipage}{#1\textwidth} #3 \end{minipage} & \begin{minipage}{#2\textwidth} #4 \end{minipage}\end{tabular}}
\newcommand{\hpages}[3]{\begin{tabular}{c|c}\begin{minipage}{#1\textwidth} #2 \end{minipage} & \begin{minipage}{#1\textwidth} #3 \end{minipage}\end{tabular}}
\newcommand{\hpagess}[4]{\begin{tabular}{c|c}\begin{minipage}{#1\textwidth} #3 \end{minipage} & \begin{minipage}{#2\textwidth} #4 \end{minipage}\end{tabular}}
\newcommand{\hpagesss}[6]{
	\begin{tabular}{c|c|c}
	\begin{minipage}[t]{#1\textwidth} #4 \end{minipage} &
	\begin{minipage}[t]{#2\textwidth} #5 \end{minipage} &
	\begin{minipage}[t]{#3\textwidth} #6 \end{minipage}
	\end{tabular}}
\newcommand{\hpagesssnl}[6]{
	\begin{tabular}{ccc}
	\begin{minipage}{#1\textwidth} #4 \end{minipage} &
	\begin{minipage}{#2\textwidth} #5 \end{minipage} &
	\begin{minipage}{#3\textwidth} #6 \end{minipage}
	\end{tabular}}


\begin{document}

%\addtocounter{chapter}{3}
\section*{Padding Oracle Attacks} 

We discuss in this addendum padding oracle attacks, which are a limited form
of CCA attacks that have proven incredibly damaging in practical settings.
At a high level, the problem is as follows. Encryption schemes are almost
always defined via a Pad-then-Encrypt methodology. First, a plaintext is
padded according to some padding rules captured by a padding 
function~$\Pad$. Then an encryption scheme $\SE$ is applied to the result. 
During decryption, one first applies the decryption algorithm of $\SE$, 
and then the resulting string is checked to see if it is consistent
with the padding rules of $\Pad$. If not, a special symbol is returned
(here $\bot$)  and the ciphertext is rejected.

In practice, implementors often have made it so that padding errors are
reported in a manner distinguishable from other types of decryption errors.
That means that an attacker can send a (chosen) ciphertext to a party
with the secret key, and observe whether that ciphertext had valid padding
or not. Here we develop attacks based on this observation.
We focus on CBC\$ mode since this seems the most vulnerable to such padding
oracle attacks (POAs).


\section{Pad-then-Encrypt} 

Let $D = (\bits^n)^+$ be the set of all strings of length a multiple of~$n$.
Let $\SYMscheme = (\kg,\enc,\dec)$ be a symmetric encryption algorithm 
with message space~$D$. Meaning all strings of length a multiple
of~$n$. An example is CBC\$ or CTR\$. A padding function $\Pad\Colon\bits^*\rightarrow D$
determines how to unambiguously map arbitrary bit strings to a string
in~$D$. We assume an inverse function $\Unpad\Colon D\rightarrow(\bits^*\cup\{\bot\})$. Both
must be efficiently computable. Then the Pad-then-Encrypt $\PTE = (\kg,\PTEenc,\PTEdec)$
associated to $\SYMscheme$ and $\Pad$ has the same key generation algorithm as $\SYMscheme$
and the following encryption and decryption algorithms.

\begin{center}
\hpagesnl{.35}{
\algorithmv{$\PTEenc_K(M)$}\\
$X \gets \Pad(M)$\\
Ret $\enc_K(X)$
}{
\algorithmv{$\PTEdec_K(C)$}\\
$X \gets \dec_K(C)$\\
If $X = \bot$ then Ret $\bot$\\
Ret $\Unpad(X)$
}
\end{center}

For schemes like CBC\$ for which $\dec$ never returns $\bot$, we have that
$\PTEdec$ returning $\bot$ indicates a padding error. Assume that our target message
space only includes messages that are a multiple of 8 bits (1 byte), that $n$ is a multiple of 8, 
and that $n \le 255\cdot 8$.
For any number $p \in [0\dotdot 255]$ let $\langle  p \rangle_8$ represent the 8-bit string
containing some canonical encoding of the number $p$. Let $\rangle Y \langle_8$ represent
the number encoded (under the same encoding) in the 8-bit string $Y$. 
Let $X'\concat Y \gets \Lastbyte(X)$
be the function that parses $X$ as $X'\concat Y$ with $|Y| = 8$.
take a string and return 
A padding mechanism used by TLS is the following:

\begin{center}
\hpagesnl{.35}{
\algorithmv{$\Pad(M)$}\\
$p \gets (n + (|M| \bmod n))/8$\\
If $p = 0$ then $p = n/8$\\
$Y \gets \langle p \rangle_8$\\
Ret $M \concat Y \concat Y \concat \cdots \concat Y$\\
}{
\algorithmv{$\Unpad(X)$}\\
$X_1\concat Y_1 \gets \Lastbyte(X)$\\
$p \gets \rangle Y_1 \langle_8$\\
If $p > n/8$ then Ret $\bot$\\
If $p = 1$ then Ret $X_1$\\
For $i = 2$ to $p$ do\\
\ind  $X_i \concat Y_i \gets \Lastbyte(X_{i-1})$\\
\ind  If  $Y_i \ne Y_1$ then Ret $\bot$\\
Ret $X_p$
}
\end{center}

\noindent where  the number of $Y$'s repeated in the string returned by $\Pad$
is exactly~$p$.

\section{A Notion of Padding Oracle Security} 

We define a game $\POA_\SYMscheme$ in \figref{fig:game-poa} to formalize 
POAs. In line with our example of CBC\$, the game assumes that
$\bits^n$ is a subset of the domain of $\SYMscheme$. The game
requires an adversary to recover a message $M^*$ chosen uniformly
given only its encryption and access to an oracle that
tells the adversary whether decryption is successful or not.
A $\POA$ adversary expects input a ciphertext, can query $\CheckPad$
a number of times (adaptively), and outputs a string in $\bits^n$.
We define $\POA$ advantage by
\begin{displaymath}
	\AdvPOA{\SYMscheme}{A} = \Prob{\POA_\SYMscheme^A\Rightarrow\true} \;.
\end{displaymath}%

\begin{figure}[t]
\center
	\fpage{.40}{
Game $\POATK_{\SYMscheme}$\smallskip

	\procedurev{Initialize}\\
	$K \getsr \kg \;;\; M^*\getsr \bits^n$ \\
	Ret $\enc_K(M^*)$\smallskip

	\procedurev{$\CheckPad(C)$}\\
	$M \gets \dec_K(C)$\\
	If $M \ne \bot$ then Ret 1\\
	Ret 0\smallskip

	\procedure{\Finalize$(M)$}\\
	Ret  $(M^* = M)$
}
\caption{POA attack game.}
\label{fig:game-poa}
\end{figure}


\section{POA against Pad-then-CBC\$} 

Here we give a $\POA$ adversary against $\PTE$ when $\SYMscheme$ is 
CBC\$ and $n = 16\cdot 8$ (as in the case of AES). See \figref{fig:poa-cbc}.
Adversary $A$ attempts to recover one byte at a time from the ciphertext
by making cleverly constructed ciphertxts that are queried to the
$\CheckPad$ oracle. The goal is to use the padding rules of $\Unpad$
in order to infer what the byte is. Let us analyze the first
run of $\FindOneByte$, i.e. the $j = 1$ case. 

Here we have that $C[0]$ is set during any iteration $i$ to $n-8$ uniformly chosen bits 
followed by the encoding of the counter of $i$ XOR'd with an 8-bit random mask $R'$. 
The idea is we are going to brute-force search for that last byte. Visualize
what occurs during decryption of Pad-then-CBC\$ of $C[0]\concat C^*[1]$. 
Let $M^* = M^*_{16}\concat \cdots \concat M^*_1$
Let $Z^*[0] = Z^*_{16}\concat \cdots \concat Z^*_1 =  E^{-1}_K(C^*[1])$. 
(These remains the same throughout the attack.) 
Let $C[0] = C_{16}\concat \cdots\concat C_1 $ (this changes each iteration).
Let $X_{k} = Z^*_k \oplus C_k$ for $1 \le k \le 16$ (these are the plaintext
bytes produced by CBC\$ $\dec$ during decryption of $C[0]C^*[1]$, and they therefore
change each iteration as well).
Then the $\Unpad$ algorithm 
will first look at $X_1$. If this value is an encoding of $1$ then
$\Unpad$ succeeds and so $\CheckPad$ will return 1. Moreover, the attacker can infer in
this case that 
\begin{displaymath}
	\langle 1 \rangle_8 = X_1 = Z^*_1 \oplus C_1 =( M^*_1 \oplus C^*_1)\oplus \langle i \rangle_8
\end{displaymath}%
and, in turn, that  $M^*_1 = \langle 1 \rangle_8 \oplus C^*_1\oplus \langle i \rangle_8$.
This happens with probability
at least $1 / 256$, with probability taken over the choice of $M'$.
What is the probability that $\CheckPad$ returns 1, but $M^*_1 \ne \langle 1 \rangle_8 \oplus C^*_1\oplus \langle i \rangle_8$.
This occurs if the padding check succeeds but $X_1 \ne \langle 1 \rangle_8$. 
This could happen if, for example, CBC\$ decryption produces the last two bytes 
as being encodings of 2. Let $\fail_i$ be the event that iteration $i$ within the
$j=1$'th iteration of $\FindOneByte$ produces a ``false positive''. Let
$B^i$ represent the
event that $X_1 = X_2 = \cdots = X_i = \langle i \rangle_8$. Then
\begin{eqnarray*}
   \Prob{M^*_1 = \langle j \rangle_8 \oplus C^*_1 \oplus \langle i \rangle_8} = 
		\Prob{\fail_i} &=& \Prob{B^2 \lor B^3 \lor \ldots \lor B^{16}}\\
		&\le & \Prob{B^2 \lor B^3 \lor \ldots \lor B^{16}}\\
\end{eqnarray*}

\begin{figure}[t]
\center
\fpage{.80}{
\adversary{$A(C^*)$}\\
Parse $C^*$ as $n$-bit strings $C^*[0],C^*[1],C^*[2]$\\
Parse $C^*[0]$ as $8$-bit strings $C^*_{16},\ldots,C^*_1$\\
For j = $1$ to $16$ do\\
\ind $X_j \gets \FindOneByte(j,C^*_{16},\ldots,C^*_1,C^*[1],X_{j-1},\ldots,X_1)$\\
\Return\ $X_{16} \concat \cdots \concat X_1$\medskip

\subroutine{$\FindOneByte(j,C^*_{16},\ldots,C^*_1,C^*[1],X_{j-1},\ldots,X_1)$}\\
For $i = 0$ to 255 do\\
\ind $R \getsr \bits^{n-8j}$\\
%\ind $R' \getsr \bits^{8}$\\
\ind $C[0] \gets R \concat \langle i \rangle_8 \concat (X_{j-1}\oplus \langle j \rangle_8 + C_{j-1}) \concat \cdots \concat (X_1 \oplus \langle 1 \rangle_8 \oplus C_1)$\\
\ind $d \gets \CheckPad(C[0]\concat C^*[1])$\\
\ind If $(d = 1)$ then \\
\ind\ind Ret $c_j \oplus \langle i \rangle_8 \oplus \langle j \rangle_8$
}
\caption{POA adversary against Pad-then-CBC\$.}
\label{fig:poa-cbc}
\end{figure}


\end{document}
