Block ciphers, modes and oracles
AES is not the target. ECB's repeated blocks, CBC's malleability, a padding oracle, a reused GCM nonce, and a predictable PRNG all are.
By the end you can
- Recognise ECB from ciphertext alone by spotting repeated blocks
- Flip a chosen bit of CBC plaintext by corrupting the previous block, and predict the collateral damage
- Turn a padding error into a decryption oracle, byte by byte
- Explain what a reused nonce costs in CTR and in GCM, and why the GCM case also forfeits authentication
- Recover the state of an LCG or MT19937 from observed output and predict the next token
- Recognise when a timing difference, not a plaintext, is the leak
1. Read
AES is fine. The mode around it is the challenge
ECB detection and cut-and-paste, CBC bit flipping, the padding oracle, and what happens when a CTR or GCM nonce repeats. Five attacks that never touch the block cipher itself, because the mode is where CTF authors put the bug.
Predicting the random: LCGs, Mersenne Twister, and seeded PRNGs
How to tell a cryptographic RNG from a statistical one, recover an LCG's parameters from a handful of outputs, untemper MT19937 back to its internal state, and beat a token generator that was seeded with the current time.
Side channels: when how long it took is the answer
Timing attacks against string comparison and modular exponentiation, error messages that distinguish too much, size and cache oracles, and the statistical discipline that separates a real signal from network noise.
2. Use the tools
In the order they come up while solving. Read what each one does, or go straight to the workspace tab that runs it.
- AES decryption tool (CBC, GCM, CTR, ECB)
Decrypt AES in every common mode and key size, with hex, Base64, or UTF-8 key material and automatic PKCS#7 padding removal. Runs on Web Crypto in your browser.
Open it in the workspace - CBC padding oracle attack
Decrypt CBC ciphertext one byte at a time using only a valid/invalid padding signal - Vaudenay’s attack, explained and driven.
Open it in the workspace - AES-GCM nonce reuse (forbidden attack)
Recover the GHASH authentication key from two messages encrypted under the same key and nonce, then forge arbitrary authenticated ciphertexts.
Open it in the workspace - Linear congruential generator predictor
Recover the modulus, multiplier, and increment of an LCG from a handful of consecutive outputs, then predict every future value.
Open it in the workspace - MT19937 state recovery and predictor
Recover the full Mersenne Twister state from 624 consecutive outputs by inverting the tempering function - then predict Python’s random module exactly.
Open it in the workspace - Cipher identifier and automatic decoder
Paste anything and find out what it is. ctfpal runs every decoder and rotation, including multi-pass cascades, and ranks results by English-likeness and flag patterns.
Open it in the workspace
3. Try one now
Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.
4. Practise on the real thing
Real picoCTF challenges that use these techniques, easiest first. 19 match in total - see the full index.
Common mistakes
The wrong turns this topic reliably produces. Written as the mistake rather than the rule, because the rule is easy to agree with and easy to walk straight past.
- Attacking AES. The block cipher is not the weakness in any of these challenges; the mode, the nonce, the padding check and the seed are.
- Reading a padding oracle as needing the key. It needs only a distinguishable error, and 'invalid padding' versus 'invalid MAC' is enough - so is a response-time difference.
- Seeding from the current time and then assuming that is unguessable. A second-resolution seed is a search space of a few thousand values.
- Flipping a bit in CBC without deciding which block to spend. The edit destroys the preceding block completely, so the attack only works when the application ignores that block or the header it lands in.
- Reading a token as unpredictable because it looks random. MT19937 falls to 624 observed outputs and an LCG to a handful, so unpredictability is a claim about the generator, never about the appearance of its output.
Checkpoint
Given a CBC-encrypted session cookie and a server that reports padding errors, recover the plaintext without the key and state how many oracle queries each byte cost.
Teaching note
Do the ECB penguin first, on a real image, before any of the maths. A class that has seen the shape survive encryption will accept 'the mode leaks structure' for the rest of the session; a class that has only been told it will not.
Go deeper
The lessons above are written to get you through a challenge. These go after the subject instead. Each one opens our notes on that chapter - what it argues, what to take from it and where it stops - so this is somewhere to read now rather than a book to buy first. Nothing here is affiliate-linked or sold by us.
Chapter 5, Cryptography
Designing Secure Software - Loren Kohnfelder
The mode and nonce rules stated as design constraints, which is exactly how they are broken in challenges.
Chapter 11, Implementing and Attacking Cryptography
Black Hat Go - Tom Steele, Chris Patten, and Dan Kottmann
Builds a CBC bit-flipping attack end to end, in code you can step through.
Chapter 7, Network Protocol Security
Attacking Network Protocols - James Forshaw
Shows the same mode mistakes where they actually ship - inside protocols carrying real sessions.
Every book the curriculum cites has a page in the library.