CBC Padding Oracle Attack — Query Lattice (2D)

Cipher Mode

Attack Controls

Oracle query rate 200/s

Recovered Plaintext (block, hex)

Bytes recovered

0 / 16

Oracle queries

Avg queries/byte

–

Est. attack time*

–

How it works

This build runs the attack against real AES-128-CBC encryption performed by the browser's own crypto.subtle — the ciphertext block, IV and every oracle response come from the actual Web Crypto API, not a simulated cipher. TLS's old CBC record cipher decrypts each 16-byte block as P_i = D_K(C_i) ⊕ C_i−1, then strips PKCS#7 padding. If a server leaks — via timing or an explicit alert — whether that padding came out valid, an attacker who can forge the previous block C′ learns one bit per query without ever touching the key K. This is the exact mechanism behind BEAST, POODLE and Lucky13 against TLS/SSL CBC suites.

The 2D lattice on the right is the actual search space: 16 rows (byte positions 15→0) × 256 columns (every possible guess byte). A cell lights up amber while it is being tested against the real crypto.subtle.decrypt oracle, red once tried-and-rejected, and green the instant that guess makes AES padding validate — which is precisely how each byte falls.

Attack a byte at position p (from 15 down to 0):
  pad = 16 − p          // padding value we're forcing
  for guess in 0..255:
    IV'[p] = guess
    IV'[k] = I[k] ⊕ pad   for k in p+1..15 (already-known bytes)
    await crypto.subtle.decrypt({iv:IV'}, key, C) → throws iff padding invalid
    if no throw:  I[p] = guess ⊕ pad             // intermediate D_K(C)[p] recovered
                  P[p] = I[p] ⊕ IV[p]             // IV is public → real plaintext byte
                  break

CBC mode — a uniformly random guess byte needs on average (256+1)/2 = 128.5 oracle queries to hit padding-valid; the lattice fill rate you see is that exact distribution, not a scripted animation.
AEAD / GCM mode — the ciphertext carries an authentication tag checked before any decryption happens. A single tampered byte fails the tag and the record is rejected outright — no padding is ever examined, so zero bits leak per query.
This is precisely why TLS 1.3 deleted CBC cipher suites from the protocol and made AEAD (AES-GCM, ChaCha20-Poly1305) mandatory.

*Estimated wall-clock time assumes each oracle query costs one network round trip (here modelled at 25 ms/query, matching real browser-based POODLE-class attacks).

rows: byte position 15→0
cols: guess byte 0x00→0xFF

CBC — VULNERABLE

Guess in progress Padding valid / recovered Padding invalid (tried) Not yet attacked

⚠ Web Crypto unavailableThis browser blocked crypto.subtle (requires a secure context). Reload over HTTPS.