two bytes are known to be 0x02, allowing both of them to be decrypted.) Therefore, the last byte of equals . If the padding is incorrect, the attacker can change the last byte of to the next possible value. At most, the attacker will need to make 256 attempts to find the last byte of , 255 attempts for every possible byte (256 possible, minus one by pigeonhole principle), plus one additional attempt to eliminate an ambiguous padding. After determining the last byte of , the attacker can use the same technique to obtain the second-to-last byte of . The attacker sets the last byte of to by setting the last byte of to . The attacker then uses the same approach described above, this time modifying the second-to-last byte until the padding is correct (0x02, 0x02). If a block consists of 128 bits (AES, for example), which is 16 bytes, the attacker will obtain plaintext in no more than 256⋅16 = 4096 attempts. This is significantly faster than the attempts required to bruteforce a 128-bit key. Encrypting messages with Padding oracle attack (CBC-R) CBC-R turns a decryption oracle into an encryption oracle, and is primarily demonstrated against padding oracles. Using padding oracle attack CBC-R can craft an initialization vector and ciphertext block for any plaintext: decrypt any ciphertext Pi = PODecrypt( Ci ) XOR Ci−1, select previous cipherblock Cx−1 freely, produce valid ciphertext/plaintext pair Cx-1 = Px XOR PODecrypt( Ci ). To generate a ciphertext that is N blocks long, attacker must perform N numbers of padding oracle attacks. These attacks are chained together so that proper plaintext is constructed in reverse order, from end of message (CN) to beginning message (C0, IV). In each step, padding oracle attack is used to construct the IV to the previous chosen ciphertext. The CBC-R attack will not work against an encryption scheme that authenticates ciphertext (using a message authentication code or similar) before decrypting. Attacks using padding oracles The original attack was published in 2002 by Serge Vaudenay. Concrete instantiations of the attack were later realised against SSL and IPSec. It was also applied to several web frameworks, including JavaServer Faces, Ruby on Rails and ASP.NET as well as other software, such as the Steam gaming client. In 2012 it was shown to be effective against some hardened security devices. While these earlier attacks were fixed by most TLS implementors following