Skip to content
All modules
CoreModule 7 of 27120 minutes

Block ciphers, modes and oracles

AES is not the target. ECB's repeated blocks, CBC's malleability, a padding oracle, a reused GCM nonce, and a predictable PRNG all are.

Assumes6. XOR and the cost of reusing a key

By the end you can

  • Recognise ECB from ciphertext alone by spotting repeated blocks
  • Flip a chosen bit of CBC plaintext by corrupting the previous block, and predict the collateral damage
  • Turn a padding error into a decryption oracle, byte by byte
  • Explain what a reused nonce costs in CTR and in GCM, and why the GCM case also forfeits authentication
  • Recover the state of an LCG or MT19937 from observed output and predict the next token
  • Recognise when a timing difference, not a plaintext, is the leak

1. Read

2. Use the tools

In the order they come up while solving. Read what each one does, or go straight to the workspace tab that runs it.

3. Try one now

Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.

4. Practise on the real thing

Real picoCTF challenges that use these techniques, easiest first. 19 match in total - see the full index.

Common mistakes

The wrong turns this topic reliably produces. Written as the mistake rather than the rule, because the rule is easy to agree with and easy to walk straight past.

  • Attacking AES. The block cipher is not the weakness in any of these challenges; the mode, the nonce, the padding check and the seed are.
  • Reading a padding oracle as needing the key. It needs only a distinguishable error, and 'invalid padding' versus 'invalid MAC' is enough - so is a response-time difference.
  • Seeding from the current time and then assuming that is unguessable. A second-resolution seed is a search space of a few thousand values.
  • Flipping a bit in CBC without deciding which block to spend. The edit destroys the preceding block completely, so the attack only works when the application ignores that block or the header it lands in.
  • Reading a token as unpredictable because it looks random. MT19937 falls to 624 observed outputs and an LCG to a handful, so unpredictability is a claim about the generator, never about the appearance of its output.

Checkpoint

Given a CBC-encrypted session cookie and a server that reports padding errors, recover the plaintext without the key and state how many oracle queries each byte cost.

Teaching note

Do the ECB penguin first, on a real image, before any of the maths. A class that has seen the shape survive encryption will accept 'the mode leaks structure' for the rest of the session; a class that has only been told it will not.

Go deeper

The lessons above are written to get you through a challenge. These are the chapters to read when you want the subject instead - each one named so you can check it rather than take our word for it. Nothing here is affiliate-linked or sold by us.

  • Designing Secure Software - Loren Kohnfelder

    Chapter 5, Cryptography

    The mode and nonce rules stated as design constraints, which is exactly how they are broken in challenges.

  • Black Hat Go - Tom Steele, Chris Patten, and Dan Kottmann

    Chapter 11, Implementing and Attacking Cryptography

    Builds a CBC bit-flipping attack end to end, in code you can step through.

  • Attacking Network Protocols - James Forshaw

    Chapter 7, Network Protocol Security

    Shows the same mode mistakes where they actually ship - inside protocols carrying real sessions.