Padding Oracle Attack CBC Mode: If the set of characters of plaintext is known, then can you speed up the process Consider AES-256, 128-bit blocks, and PKCS#5 Padding.
During a Padding Oracle Attack, a manipulated byte of cipher text is sent to the oracle and we eventually hope to find out what that respective byte of plaintext was.
If I know the set of possible characters in the plaintext will only be lowercase english letters, then is there any way in which I can speed up the deciphering process? If so, then specifically what would this look like?
I will assume you generally understand the mechanics of the padding oracle attack. Say we have some ciphertext block $c_i = c_{i-1} \oplus E(k,m_i)$ and we want to find the last byte of $m_i$. Let $b$ denote the last byte of $m_i$, which we are trying to find.
Consider ciphertexts of the form $(c_{i-1} \oplus \texttt{00} \cdots \texttt{00} g,c_i)$, where $g$ is a single byte. Such a ciphertext decrypts to $m_i$, except the last byte has been changed from $b$ to $b \oplus g$. When the server decrypts, it sees a string that ends in byte $b \oplus g$ --- does this string have valid padding? In most cases, it has valid padding only when $b \oplus g = \texttt{01}$ (lets assume that $m_i$ doesn't end in $\cdots \texttt{02}\,b$ or $\cdots \texttt{0303}\,b$, etc). When the server tells us which choice of $g$ leads to valid padding, we can solve for $b = \texttt{01} \oplus g$.
If you know that $b$ is one of only 26 possible values, then there are only 26 possible values of $g$ that you need to try -- compared to the general case where you have to try all 256 choices of byte $g$. I only mentioned the case of finding the last byte of the plaintext, but the same logic applies for any byte.