Block ciphers, modes and oracles

Before the session

• Nothing to install. Students need a browser and https://ctfpal.com. Confirm the room can reach it once; after that it works offline.
• Read the lesson yourself first - about 24 minutes.
• Have one worked example ready to paste. The classroom link builder on the instructor page turns it into a URL that opens preloaded.

Objectives

Written as things a student can do afterwards, so they can be assessed rather than asserted.

1. Recognise ECB from ciphertext alone by spotting repeated blocks
2. Flip a chosen bit of CBC plaintext by corrupting the previous block, and predict the collateral damage
3. Turn a padding error into a decryption oracle, byte by byte
4. Explain what a reused nonce costs in CTR and in GCM, and why the GCM case also forfeits authentication
5. Recover the state of an LCG or MT19937 from observed output and predict the next token
6. Recognise when a timing difference, not a plaintext, is the leak

Running order (120 min)

Tools used

• AES decryption tool (CBC, GCM, CTR, ECB) - Decrypt AES in every common mode and key size, with hex, Base64, or UTF-8 key material and automatic PKCS#7 padding removal. Runs on Web Crypto in your browser.https://ctfpal.com/?tool=aes-decrypt
• CBC padding oracle attack - Decrypt CBC ciphertext one byte at a time using only a valid/invalid padding signal - Vaudenay’s attack, explained and driven.https://ctfpal.com/?tool=padding-oracle-attack
• AES-GCM nonce reuse (forbidden attack) - Recover the GHASH authentication key from two messages encrypted under the same key and nonce, then forge arbitrary authenticated ciphertexts.https://ctfpal.com/?tool=aes-gcm-nonce-reuse
• Linear congruential generator predictor - Recover the modulus, multiplier, and increment of an LCG from a handful of consecutive outputs, then predict every future value.https://ctfpal.com/?tool=lcg-predictor
• MT19937 state recovery and predictor - Recover the full Mersenne Twister state from 624 consecutive outputs by inverting the tempering function - then predict Python’s random module exactly.https://ctfpal.com/?tool=mt19937-predictor
• Cipher identifier and automatic decoder - Paste anything and find out what it is. ctfpal runs every decoder and rotation, including multi-pass cascades, and ranks results by English-likeness and flag patterns.https://ctfpal.com/?tool=cipher-identifier

Reading

• AES is fine. The mode around it is the challenge - 9 min. ECB detection and cut-and-paste, CBC bit flipping, the padding oracle, and what happens when a CTR or GCM nonce repeats. Five attacks that never touch the block cipher itself, because the mode is where CTF authors put the bug.
• Predicting the random: LCGs, Mersenne Twister, and seeded PRNGs - 8 min. How to tell a cryptographic RNG from a statistical one, recover an LCG's parameters from a handful of outputs, untemper MT19937 back to its internal state, and beat a token generator that was seeded with the current time.
• Side channels: when how long it took is the answer - 7 min. Timing attacks against string comparison and modular exponentiation, error messages that distinguish too much, size and cache oracles, and the statistical discipline that separates a real signal from network noise.

Practice set

Real picoCTF challenges tagged with this module’s techniques, easiest first. Assign the first three in class and the rest as homework.

1. Black Cobra Pepper - picoCTF 2026, medium
2. Chronohack - picoCTF 2025, medium
3. cryptomaze - picoCTF 2026, medium
4. Nothing Up My Sleeve - picoCTF 2020 Mini-Competition, medium
5. rsa_oracle - picoCTF 2024, medium
6. shift registers - picoCTF 2026, medium
7. Timestamped Secrets - picoCTF 2026, medium
8. AES-ABC - picoCTF 2019, hard
9. Clouds - picoCTF 2021, hard
10. Compress and Attack - picoCTF 2021, hard
11. Double DES - picoCTF 2021, hard
12. JITFP - picoCTF 2026, hard

Checkpoint (gradeable)

Given a CBC-encrypted session cookie and a server that reports padding errors, recover the plaintext without the key and state how many oracle queries each byte cost.

Deliberately a produced artefact rather than a quiz question: it is either there or it is not, which makes it fast to mark and hard to bluff. Every tool in ctfpal is deterministic, so two students who did the work correctly hand in the same value.

Where the room gets stuck

Do the ECB penguin first, on a real image, before any of the maths. A class that has seen the shape survive encryption will accept 'the mode leaks structure' for the rest of the session; a class that has only been told it will not.

• Attacking AES. The block cipher is not the weakness in any of these challenges; the mode, the nonce, the padding check and the seed are.
• Reading a padding oracle as needing the key. It needs only a distinguishable error, and 'invalid padding' versus 'invalid MAC' is enough - so is a response-time difference.
• Seeding from the current time and then assuming that is unguessable. A second-resolution seed is a search space of a few thousand values.
• Flipping a bit in CBC without deciding which block to spend. The edit destroys the preceding block completely, so the attack only works when the application ignores that block or the header it lands in.
• Reading a token as unpredictable because it looks random. MT19937 falls to 624 observed outputs and an LCG to a handful, so unpredictability is a claim about the generator, never about the appearance of its output.

If a student wants the subject, not the answer

Chapter-level references, so a student can be pointed at twenty pages rather than at a book. Nothing here is required to complete the module.

• Designing Secure Software, Loren Kohnfelder. Chapter 5, Cryptography. The mode and nonce rules stated as design constraints, which is exactly how they are broken in challenges.
• Black Hat Go, Tom Steele, Chris Patten, and Dan Kottmann. Chapter 11, Implementing and Attacking Cryptography. Builds a CBC bit-flipping attack end to end, in code you can step through.
• Attacking Network Protocols, James Forshaw. Chapter 7, Network Protocol Security. Shows the same mode mistakes where they actually ship - inside protocols carrying real sessions.

If you finish early

• Hand out a challenge from the cross-CTF index in this category - each one has published solutions to compare afterwards.
• Run the same input through Identify and let the class argue with the ranking. Disagreeing with a confidence score is where the technique actually lands.
• Ask a student to break their own example - construct an input that defeats the tool, and explain why.