symmetric-cipher-attacks

SKILL: Symmetric Cipher Attacks — Expert Cryptanalysis Playbook

AI LOAD INSTRUCTION: Expert techniques for attacking symmetric encryption in CTF and authorized testing. Covers CBC padding oracle, CBC bit flipping, ECB detection and exploitation, stream cipher key reuse, LFSR/LCG state recovery, RC4 biases, and meet-in-the-middle attacks. Base models often confuse ECB and CBC attack strategies or fail to set up byte-at-a-time ECB decryption correctly.

0. RELATED ROUTING

• rsa-attack-techniques when symmetric key is protected by RSA
• hash-attack-techniques when HMAC or hash-based authentication is involved
• lattice-crypto-attacks for LCG/LFSR state recovery via lattice methods

Advanced Reference

Also load BLOCK_CIPHER_ATTACKS.md when you need:

• Detailed attack scripts with full Python implementations
• Step-by-step byte-at-a-time ECB walkthrough
• PadBuster usage and custom padding oracle scripts
• LCG/LFSR recovery implementation

Quick attack selection

Observable Behavior	Likely Weakness	Attack
Same plaintext → same ciphertext (block-aligned)	ECB mode	Cut-and-paste / byte-at-a-time
Padding error distinguishable	CBC padding oracle	Decrypt without key
Can modify ciphertext, affects next block	CBC mode, no integrity check	Bit flipping
Key reused with XOR/stream cipher	Two-time pad	XOR ciphertexts together
Predictable PRNG output	LCG or LFSR	State recovery
Double encryption used	2DES-like	Meet in the middle

---

1. PADDING ORACLE ATTACK (CBC MODE)

1.1 Mechanism

CBC decryption: P_i = D_K(C_i) ⊕ C_{i-1}

If the server reveals whether padding is valid (PKCS#7), we can decrypt any block by manipulating the previous ciphertext block.

1.2 Attack Steps

Target: decrypt block C_i (with unknown plaintext P_i)

For byte position b = 15 down to 0 (last byte first):
  padding_value = 16 - b
  
  For guess = 0x00 to 0xFF:
    Construct modified C'_{i-1}:
      - Bytes 0..b-1: original C_{i-1} bytes
      - Byte b: guess
      - Bytes b+1..15: calculated to produce correct padding
    
    Send (C'_{i-1} || C_i) to oracle
    
    If oracle says "valid padding":
      intermediate_byte[b] = guess ⊕ padding_value
      plaintext_byte[b] = intermediate_byte[b] ⊕ original_C_{i-1}[b]