Summary
A padding-oracle vulnerability in the C# Bouncy Castle IES engine produces distinguishable responses when padded ciphertext decryption fails before MAC verification. An attacker who can submit modified ciphertexts for decryption under the same key pair may use these differences to recover the plaintext of a captured IES or ECIES ciphertext.
A padding-oracle vulnerability in the C# Bouncy Castle IES engine produces distinguishable responses when padded ciphertext decryption fails before MAC verification. An attacker who can submit modified ciphertexts for decryption under the same key pair may use these differences to recover the plaintext of a captured IES or ECIES ciphertext.
Affected context
The issue affects applications that directly construct IesEngine with a padded block cipher, such as AES in CBC mode with PKCS#7 padding. It does not generally apply to stream-mode IES, and exploitation depends on an attacker being able to submit altered ciphertexts for decryption and observe distinguishable failure behavior.
The issue affects applications that directly construct IesEngine with a padded block cipher, such as AES in CBC mode with PKCS#7 padding. It does not generally apply to stream-mode IES, and exploitation depends on an attacker being able to submit altered ciphertexts for decryption and observe distinguishable failure behavior.
Exploit preconditions
- Attack surface: An application endpoint, service, or API that accepts IES or ECIES ciphertexts for decryption
- Required access: Ability to submit modified ciphertexts and observe decryption outcomes
- Key requirement: The target must decrypt under the same key pair used for the captured ciphertext
- Trigger point: Decryption of a ciphertext using a padded block cipher configured through
IesEngine - Why exploitation is possible: Padding is removed before MAC verification, and padding failures produce a distinguishable response without equivalent MAC-processing behavior
- Attack surface: An application endpoint, service, or API that accepts IES or ECIES ciphertexts for decryption
- Required access: Ability to submit modified ciphertexts and observe decryption outcomes
- Key requirement: The target must decrypt under the same key pair used for the captured ciphertext
- Trigger point: Decryption of a ciphertext using a padded block cipher configured through
IesEngine - Why exploitation is possible: Padding is removed before MAC verification, and padding failures produce a distinguishable response without equivalent MAC-processing behavior
Why this happens
The underlying bug is an observable discrepancy in cryptographic error handling. In the affected block-cipher path, the engine decrypts and validates padding before verifying the MAC, allowing padding failures and MAC failures to follow measurably different paths and produce different messages.
This maps to CWE-203: Observable Discrepancy, because security-relevant internal states are exposed through distinguishable externally visible behavior. Repeated adaptive observations can turn that discrepancy into a padding-oracle signal.
The underlying bug is an observable discrepancy in cryptographic error handling. In the affected block-cipher path, the engine decrypts and validates padding before verifying the MAC, allowing padding failures and MAC failures to follow measurably different paths and produce different messages.
This maps to CWE-203: Observable Discrepancy, because security-relevant internal states are exposed through distinguishable externally visible behavior. Repeated adaptive observations can turn that discrepancy into a padding-oracle signal.
Potential impact
- An attacker may recover plaintext from captured IES or ECIES ciphertext
- Confidential application data could be disclosed without recovering the encryption key
- Sensitive tokens, records, or protocol messages may be exposed
- Applications may experience increased decryption traffic from adaptive probing
- Related cryptographic workflows could be weakened if they reuse the same vulnerable decryption endpoint
- An attacker may recover plaintext from captured IES or ECIES ciphertext
- Confidential application data could be disclosed without recovering the encryption key
- Sensitive tokens, records, or protocol messages may be exposed
- Applications may experience increased decryption traffic from adaptive probing
- Related cryptographic workflows could be weakened if they reuse the same vulnerable decryption endpoint
General mitigation guidance
Mitigation generally focuses on removing distinguishable cryptographic failure paths and ensuring that ciphertext authenticity is established before exposing plaintext-dependent behavior.
Common defensive patterns include:
- Prefer authenticated-encryption designs that authenticate ciphertext before decryption where the protocol permits
- Ensure padding failures and authentication failures produce indistinguishable external responses and comparable processing behavior
- Avoid exposing detailed cryptographic error messages, timing differences, or status distinctions to untrusted callers
- Restrict who can submit ciphertexts for decryption and apply rate limits, monitoring, and authorization controls
- Avoid directly composing padded block ciphers with legacy encryption schemes unless their security properties and failure handling are well understood
- Use cryptographic library configurations and APIs that enforce authenticated decryption and safe error handling by default
Mitigation generally focuses on removing distinguishable cryptographic failure paths and ensuring that ciphertext authenticity is established before exposing plaintext-dependent behavior.
Common defensive patterns include:
- Prefer authenticated-encryption designs that authenticate ciphertext before decryption where the protocol permits
- Ensure padding failures and authentication failures produce indistinguishable external responses and comparable processing behavior
- Avoid exposing detailed cryptographic error messages, timing differences, or status distinctions to untrusted callers
- Restrict who can submit ciphertexts for decryption and apply rate limits, monitoring, and authorization controls
- Avoid directly composing padded block ciphers with legacy encryption schemes unless their security properties and failure handling are well understood
- Use cryptographic library configurations and APIs that enforce authenticated decryption and safe error handling by default
How teams detect issues like this
Detection can include static analysis and code review for direct construction of IesEngine with padded block ciphers, particularly CBC mode with PKCS#7 padding. Reviewers should look for decryption code that removes padding before authentication, returns separate padding and MAC errors, or exposes timing and status differences across failure paths.
Runtime monitoring can identify repeated modified-ciphertext submissions, high rates of decryption failures, and clients probing related ciphertexts under one key pair. Policy enforcement may require authenticated encryption, uniform cryptographic error responses, and bounded decryption attempts. Automated security review tools can help flag risky cipher composition and distinguishable error handling.
Detection can include static analysis and code review for direct construction of IesEngine with padded block ciphers, particularly CBC mode with PKCS#7 padding. Reviewers should look for decryption code that removes padding before authentication, returns separate padding and MAC errors, or exposes timing and status differences across failure paths.
Runtime monitoring can identify repeated modified-ciphertext submissions, high rates of decryption failures, and clients probing related ciphertexts under one key pair. Policy enforcement may require authenticated encryption, uniform cryptographic error responses, and bounded decryption attempts. Automated security review tools can help flag risky cipher composition and distinguishable error handling.
