def test_cbc_padding_oracle_length_256(key, base_iv, plaintext):
cipher = AES.new(key, AES.MODE_CBC, iv=base_iv)
ciphertext = list(
block_chunks(cipher.encrypt(pad(plaintext, AES.block_size)), AES.block_size)
)
def oracle(iv, ciphertext):
cipher = AES.new(key, AES.MODE_CBC, iv=iv)
plaintext = cipher.decrypt(ciphertext)
try:
unpad(plaintext, AES.block_size)
return True
except ValueError:
return False
assert len(plaintext) == cbc_padding_oracle_length(base_iv, ciphertext, oracle)
def test_cbc_padding_oracle_arbitrary_256(key, base_iv, plaintext):
plaintext = pad(plaintext, AES.block_size)
cipher = AES.new(key, AES.MODE_CBC, iv=base_iv)
ciphertext = list(block_chunks(cipher.encrypt(plaintext), AES.block_size))
def oracle(iv, ciphertext):
cipher = AES.new(key, AES.MODE_CBC, iv=iv)
plaintext = cipher.decrypt(ciphertext)
try:
unpad(plaintext, AES.block_size)
return True
except:
return False
recovered = b"".join(list(cbc_padding_oracle(base_iv, ciphertext, oracle)))
assert plaintext == recovered
def test_guess_cbc_byte(key, base_iv, plaintext):
plaintext = pad(plaintext, AES.block_size)
cipher = AES.new(key, AES.MODE_CBC, iv=base_iv)
ciphertext = list(block_chunks(cipher.encrypt(plaintext), AES.block_size))
def oracle(iv, ciphertext):
cipher = AES.new(key, AES.MODE_CBC, iv=iv)
plaintext = cipher.decrypt(ciphertext)
try:
unpad(plaintext, AES.block_size)
return True
except:
return False
for byte_pos in range(len(base_iv)):
recovered = guess_cbc_byte(
base_iv, ciphertext[0], oracle, byte_pos, plaintext[byte_pos + 1 : 16]
)
assert recovered == plaintext[byte_pos].to_bytes(1, byteorder="big")
def test_cbc_padding_oracle_single():
plaintext = pad(b"A" * 30, AES.block_size)
key = unhexlify("deadbeef" * 4)
base_iv = unhexlify("beefdead" * 4)
cipher = AES.new(key, AES.MODE_CBC, iv=base_iv)
ciphertext = list(block_chunks(cipher.encrypt(plaintext), AES.block_size))
def oracle(iv, ciphertext):
cipher = AES.new(key, AES.MODE_CBC, iv=iv)
plaintext = cipher.decrypt(ciphertext)
try:
unpad(plaintext, AES.block_size)
return True
except:
return False
recovered = b"".join(list(cbc_padding_oracle(base_iv, ciphertext, oracle)))
assert len(plaintext) == len(recovered)
assert plaintext == recovered