Does a cryptographic oracle have to be a server? I've been told that oracles are always servers and that oracle attacks are always online, but I'm not convinced that's true. However, I have limited understanding of this topic since I'm still learning and the book I just read didn't discuss it at all. The definitions I've seen of the term don't specify whether oracle attacks are always online/involve servers either.

Is an oracle always a server?
Can padding oracle attacks happen offline (e.g. an encryption tool)?
Can partitioning oracle attacks happen offline (e.g. an encryption tool)?

Please explain things in layman's terms.
In Theory: No. How the Oracle is implemented or named is not important, only how it works.
In Practice: Everything that leaks information can be abstracted as an Oracle. So it is also possible to use the client as an oracle, or the systems processing the cryptosystems. The Server Client system is only the most common way how stuff works and communicates in the world wide web, but the important aspect is, that cryptography is used for a lot more that only &quot;the internet&quot;.
A good example are operating systems. They are (for simplicity) offline systems, but you could also identify oracles and other mechanism in the cryptographic applications used for the OS. OS also use block ciphers, therefore it can be possible to make an offline padding oracle attack.
I hope I was able to give an adequate answer!