Padding oracle: decrypting without the key

In CBC with PKCS#7 padding, the decrypted text must end with valid padding. If the server responds differently when padding is wrong, you have an oracle.

How it works

CBC XORs the decrypted block with the previous one. By tweaking the last byte of the previous block and watching when padding becomes valid, you recover the intermediate byte, hence the plaintext. Repeat for each byte, each block. About 128 requests per block.

P[i] = D(C) XOR C_prev
# tweak C_prev until padding is valid -> recover D(C)

Defence

Use authenticated encryption (AES-GCM, ChaCha20-Poly1305): the tag is verified before decryption, and a tampered ciphertext is rejected without revealing anything. If you stay on CBC, use encrypt-then-MAC and verify the MAC in constant time before padding. No differentiated errors.