CBC Padding Oracle Attack on TLS

Before TLS 1.3, browsers negotiated CBC-mode block ciphers whose record layer decrypted each 16-byte block as D_K(C_i) ⊕ C_i−1 and then stripped PKCS#7 padding — and if a server ever signalled, even indirectly through timing, whether that padding came out valid, it handed an attacker a one-bit oracle per query. This simulator renders the attack live in 3D: three rows of instanced byte-blocks represent the attacker-forged previous ciphertext block, the fixed target ciphertext block, and the plaintext byte being recovered, while the actual Vaudenay padding-oracle algorithm runs underneath — trying up to 256 guesses per byte position and confirming each one against a real padding check. Switch the cipher mode to AEAD/GCM to see why the same attack is instantly rejected: authenticated encryption checks the integrity tag before touching the padding at all, which is exactly why TLS 1.3 made AEAD ciphers mandatory and dropped CBC suites entirely.