CBC Padding Oracle Attack on TLS

Cipher Mode

Attack Controls

Oracle query rate 200/s

Recovered Plaintext (block, hex)

Bytes recovered

0 / 16

Oracle queries

Avg queries/byte

–

Est. attack time*

–

How it works

TLS's old CBC-mode record cipher decrypts each 16-byte block as P_i = D_K(C_i) ⊕ C_i−1, then strips PKCS#7 padding. If the server leaks — via timing or an explicit alert — whether the resulting padding was valid, an attacker who can inject a chosen previous block C′ learns one bit per query without ever knowing the key K. This is the exact mechanism behind BEAST, POODLE and Lucky13 against TLS/SSL CBC suites.

Attack a byte at position p (from 15 down to 0):
  pad = 16 − p          // padding value we're forcing
  for guess in 0..255:
    C'[p] = guess
    C'[k] = I[k] ⊕ pad   for k in p+1..15 (already-known bytes)
    send (C', C_target) to server → oracle: valid padding?
    if valid:  I[p] = guess ⊕ pad        // intermediate D_K(C_target)[p] recovered
               P[p] = I[p] ⊕ C_prev_real[p]   // real plaintext byte
               break

CBC mode — up to 256 oracle queries recover one plaintext byte (average 128); the whole 16-byte block falls in a few thousand queries total.
AEAD / GCM mode — the ciphertext carries an authentication tag checked before any decryption happens. A single tampered byte fails the tag and the record is rejected outright — no padding is ever examined, so zero bits leak per query.
This is precisely why TLS 1.3 deleted CBC cipher suites from the protocol and made AEAD (AES-GCM, ChaCha20-Poly1305) mandatory.

*Estimated wall-clock time assumes each oracle query costs one network round trip (here modelled at 25 ms/query, matching real browser-based POODLE-class attacks).

C′ (attacker-chosen previous block) C (target ciphertext block, fixed) Recovered plaintext byte

CBC — VULNERABLE

Guess in progress Padding valid / recovered Not yet attacked

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.