What is a padding oracle attack and how is it mitigated?

• A. An attack exploiting padding error information during decryption to infer plaintext; mitigations include AEAD
• B. An attack on DNS
• C. An attack on password hashes
• D. An attack on certificate validity

Answer: (A)

Padding oracle vulnerabilities come from decryption that reveals whether the decrypted padding is valid. An attacker can submit crafted ciphertexts to a decryption service and observe responses or behavior that depend on whether the padding is correct. By carefully varying the ciphertext and tracking these hints, the attacker can gradually uncover the plaintext block by block, essentially turning padding validity into a side channel for information leakage.

The best defense is authenticated encryption, such as AES-GCM or ChaCha20-Poly1305. These schemes provide both confidentiality and integrity, so any tampering or invalid padding causes the entire decryption to fail with a single, uniform authentication error rather than signaling padding validity. This removes the padding oracle, because the attacker no longer receives actionable clues from padding checks. Additional practical mitigations include avoiding detailed padding error messages and ensuring decryption paths perform integrity checks before exposing any plaintext, often by using the AEAD's built-in authentication rather than separate padding verification alone.

These other options describe attacks that target DNS, password hashes, or certificate validity, which are unrelated to the padding oracle vulnerability described here.