Skip to content

added parallel processing and decryption guessing #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

ettisan
Copy link

@ettisan ettisan commented Aug 12, 2019

I found that padding oracle attacks are normally rather slow and therefore I looked for ways to speed up the process. I've achieved this through:

  • When decrypting, instead of having to guess 256 characters, it is often possible to make a good guess and only have to verify the guess. I've added a method "guess" to be implemented by the user that receives the already decrypted suffix and may guess which characters are likely to be found next (e.g. "???dingoracle" - guess "pad"). Also printable characters are preferred and if padding is detected, first the padding bytes are tested (e.g. "?\x04\x04" -> guess "\x04").
  • Instead of testing each of the 256 possibilities consecutively, it is possible to test them in parallel (threads). This is especially useful if the oracle takes quite some time to respond. Note the first optimization may suffer from this as due to multithreading the attack no longer strictly tries the most likely bytes first - it may only be usefull in cases of where the oracle has large response times.

In the process I've somewhat redesigned the library in order to be able to accommodate these changes. Though I've tested the new code it might therefore be less stable.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant