5 ms·

Padding is an important part of CBC.

• dragontamer 4y ago
  [flagged]
  • tptacek 4y ago
    No, to all of this.
  • deleted 4y ago
    [deleted]
  • bawolff 4y ago
    By that metric all security vulnerabilities can be explained away as a fault in a different part of the system.
  • IncRnd 4y ago
    > Furthermore, padding oracles are completely irrelevant to data at rest, like as described in this topics use case. So it really is a bit of a non sequitur too. That's not true and extremely dangerous to say. In an offline, black-box scenario no server is needed for a padding-oracle. You are thinking of a side-channel oracle. A padding-oracle attack can absolutely be feasible in many cases.
    • dragontamer 4y ago
      I appreciate your efforts at actually elevating this discussion. Yes, I said something too general when I really was just trying to describe _this_ particular HTML-page encryption implementation. You're right that its possible that an offline decryption algorithm could in fact be a padding oracle under the right scenario. But I still posit it probably doesn't apply to this static-HTML page generator.