all right and the other one i wanted to show you is the one we talked about so many times the padding oracle attack which you can go through here and solve pretty simple a pretty simple case of it so it's the same thing you just do it all in immediate python right here so i'll just um leave and clear the screen and then python 3 again all right so here's the background we talked about this before if you encrypt 48 bytes you have three blocks of 16 bytes you add the you xor the initialization vector with the plain text and add the key go through encryption and you get the first blocks of ciphertext you take the output of this as the iv for the next block and the output of this as the iv for the next block so your three blocks of plain text turn into three blocks of cypher text that's eight yes in cypher block chaining mode if you have 47 bytes then you've got a byte that's missing here and so you have to somehow pad it and the system we use pk cs number seven is if you only need one byte of padding you use zero one if you do two bytes use zero two zero two and so on so when you decrypt it if you take the ciphertext and decrypt it you will always get a zero one here for the one byte padding because you had 47 bytes of plain text so the correct decryption will give you a zero one as the last byte now if you modify a byte if you modify this byte of ciphertext it scrambles this whole block because that's the issue we talked about diffusion and whatever the other properties diffusion and confusion are the two properties changing any part of the cipher text will reflect every part of the plain text so this whole byte will turn into garbage this whole block but it'll only change this one byte here with the xor operation so all right so we can do this if i encrypt with aes here all right so here i've got a key i just put in six uh 16 bytes of key and 16 bytes of iv i create aes mode cipher block chaining with the iv and then i encrypt this string hello from aes and i forgot to put a closing quote on it there so that's the input plain text is a so now i encrypt it and print the ciphertext all right so that's the encrypted block and i've only got 16 bytes this is one block of data encrypting to one block now i can decrypt it i have to make a new object like i mentioned before a new aes object and then i can decrypt it so i just cipher decrypt ciphertext and off you go there's the original data and there's the hex encoded version of it so encryption and decryption works like that now we're going to do padding and chaining so here is a text that is 47 bytes long all right now if i want to encrypt it i'm going to have to add a one to the end a single byte of one because it won't encrypt unless i fill the block so this that makes ciphertext i will encrypt not just the plain text but the plain text plus one a byte of one at the end and so there's the um the ciphertext in hex and here's the modified cipher text now so i made two i made one this is the original one with correct padding this is the message with incorrect padding i put a 255 in the last byte instead of a one and as you can see that changes everything well actually not everything let me bring this out because i changed that one value there the first block is unchanged um right down uh ciphertext oh okay right now i'm just looking at plain text so i changed one byte and you'll find it someplace towards the end here um let me check my diagram here it is the 5c has changed to ff this 5c has changed to f i'm just looking at the plain text so i have 48 bytes of plain text and it's all the same except that one byte has changed now i'm gonna um right and now i'm gonna decrypt it which is here there i decrypt the um cyber text and i decrypt the mod and here we go and so these are identical and they're going to start being different around here i've 36 6 okay it's identical 746 747 okay here's the first block and this is exactly the same the next block is totally different 65 70 and so on the third block is going to start being identical again 66 7665 7665 so this block is totally different this block is all the same except the last byte went from zero one to eight h so there you can see the pattern by changing this one byte here i changed a whole block and just one byte at the end that's the key to doing this so now we make a vulnerable function an easy way to do it in python to simulate what happened in vulnerable software you make this thing called padr. pi in the directory you're working in and now you can import from this library you can make your own python library that simple just have a uh to find a few functions in a code so save that call it pad or dot pi and then you can import from paddle. pi incur ducker to encrypt and decrypt so now we can just encrypt and decrypt with that padding oracle system which is designed to demonstrate this vulnerability so um uh all right it didn't find okay i must be in the wrong directory let's see where i am um pwd i got to be in 141 okay and i got to be in pad or there and now if i do ls there's my pad or dot pi okay i can do it in here all right now there we go from paddle where i encrypt import encrypt and decrypt here's my 47 byte sentence i encrypt it and there's the answer so this is the encrypted 47 bytes now i'm going to decrypt it and notice the decryption ends in zero one it's correctly padded with a zero one and so the decryption finds a zero one at the end now we're gonna modify it we're gonna make a modified one that changes the last byte and then decrypt that and now we get padding error so if the padding is correct you get the answer if the padding is incorrect it tells you you have a padding error and that is the fundamental vulnerability the fact that you can tell this case from that case means i know if the last byte is correct and that we're going to uh use so here's the game we're going to determine these intermediate values here and then we can craft a message that will decrypt to something so we want to take a sentence that does not include the word win and insert the word win so here's the sentence you start from the sentence clearly says i'm a loser and i want to add the word wind and i'm going to place that so i encrypt it and here's the encrypted stuff that's sent at the other end and i want to make forged ciphertext that will decrypt to something containing the word win so i want to find those intermediate values and here's how you might find the first one you can try various values what this will do is it going to just try five guesses it's going to take the um the 32nd byte the end of the second block and replace it with zero one two three and four and then decrypt each one and all of them have padding errors so that's reasonable because i've changed it to something wrong all right so now what i want to do is find valid values so i'm going to find the ones that do not have padding errors now that i know it's going to say padding error if it's wrong so i'm going to try all possible values of 256 and i'm only going to print out the ones that do not return padding error and now there are two that are correctly padded one of them is going to be the original value now it's bytes of 31.
so if i look at original of 31 that's 154 so this one is correctly padded because that was the original unmodified ciphertext this is the one that must result in a zero one at the end to be correctly padded so i now know a value of one of these intermediate values i know that um it is you can calculate it from that now one there's an income is it an irritating thing because it gave me two answers i'd rather just have one answer so what i'm going to do is fill all the these values here with just aaa so they're going to decrypt into garbage so now there will be nothing valid except the one that ends in zero one there will not be the original one anymore this is a way to make it more efficient so i replace the rest of the block i'm not using with junk and now only one value will be padded and it's the 147. the original value will no longer decrypt correctly so now i can easily find the good ones all right so now that i have an algorithm i can calculate intermediate 47 which is of course by just xoring these other two values you xor this ciphertext and i know this how the last body is calculated so i can give you get the intermediate value it's ciphertext 31 xor plain text 47 and i know that the plain text is 0 1. so i know this is 0 1 and i know what number i put there so i just xor them and i'll have the number that must go here that's all you have to do so i can deduce the value of that byte in this calculation and that byte is 146.
