padding attack vs. PKCS7

travis+ml-cryptography at travis+ml-cryptography at
Thu Jun 11 12:37:16 EDT 2009

Towards the end of this rather offbeat blog post they describe a
rather clever attack which is possible when the application provides
error messages (i.e. is an error oracle) for PKCS7 padding in e.g. AES
CBC-encrypted web authenticators that allows an adversary to attack
the crypto one octet at a time.
Obama Nation | My emails do not have attachments; it's a digital signature
that your mail program doesn't understand. | 
If you are a spammer, please email john at to get blacklisted.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <>

More information about the cryptography mailing list