Bleichenbacher Attack in Phoenix

The Bleichenbacher attack exploits how Phoenix applications handle RSA padding errors during TLS handshakes. When a Phoenix server receives a malformed RSA ciphertext, the timing differences between handling padding errors versus successful decryption can leak information about the private key.

In Phoenix applications, this typically manifests in two ways:

First, the TLS termination layer (often Cowboy or Plug) may reveal timing information through error responses. When an attacker sends modified RSA ciphertexts, the server's response time varies depending on whether the padding was valid or not. This timing oracle allows attackers to gradually decrypt messages without knowing the private key.

Second, Phoenix applications that implement custom RSA decryption logic in Elixir/Erlang are particularly vulnerable. The BEAM VM's garbage collection and process scheduling can introduce timing variations that amplify the attack surface.

Consider this vulnerable pattern in a Phoenix controller: