Re:Password protect a static HTML page
by password11 on Saturday February 18, 2023 @02:18PM
(#34850095)
Padding is an important part of CBC.
[ Parent
| on HN ]
Re:Password protect a static HTML page
by dragontamer on Saturday February 18, 2023 @02:37PM
(#34850264)
There is a huge difference.
A padding oracle attack can attack any system that uses CBC + padding, even when CBC is perfectly implemented.
What I asked for earlier was a vulnerability due to an improper implementation of CBC.
Re:Password protect a static HTML page
by tptacek on Saturday February 18, 2023 @02:53PM
(#34850382)
No, to all of this.
Re:Password protect a static HTML page
by bawolff on Saturday February 18, 2023 @08:22PM
(#34853087)
By that metric all security vulnerabilities can be explained away as a fault in a different part of the system.
> Furthermore, padding oracles are completely irrelevant to data at rest, like as described in this topics use case. So it really is a bit of a non sequitur too.
That's not true and extremely dangerous to say. In an offline, black-box scenario no server is needed for a padding-oracle. You are thinking of a side-channel oracle. A padding-oracle attack can absolutely be feasible in many cases.
Re:Password protect a static HTML page
by dragontamer on Saturday February 18, 2023 @11:03PM
(#34854231)
I appreciate your efforts at actually elevating this discussion. Yes, I said something too general when I really was just trying to describe _this_ particular HTML-page encryption implementation.
You're right that its possible that an offline decryption algorithm could in fact be a padding oracle under the right scenario. But I still posit it probably doesn't apply to this static-HTML page generator.