Bleichenbacher Attack in Phoenix with Api Keys

A Bleichenbacher attack is a cryptographic timing-based adaptive chosen-ciphertext attack originally described against PKCS#1 v1.5 padding in RSA encryption. In the context of an API framework such as Phoenix, the attack surface shifts to how API keys are validated, transmitted, and compared. When Phoenix applications accept API keys via headers (e.g., Authorization: ApiKey {key}) and then perform key lookup followed by a comparison, the behavior of that comparison can introduce timing differences exploitable in a Bleichenbacher-style adaptive attack.

Consider a naive implementation that retrieves an API key record from storage and then compares the provided key with the stored key using a standard equality check. In many languages, string comparison short-circuits on the first mismatching byte. An attacker can send many requests with a guessed key and observe whether the request is rejected early (fast failure) or proceeds further (slower rejection due to additional processing or a delayed timing response). Over many adaptive queries—similar to the original Bleichenbacher approach where ciphertexts are submitted and server behavior reveals padding validity—the attacker can gradually deduce the correct API key byte by byte. This is especially relevant when keys are high-entropy but not uniformly protected against side channels.

In Phoenix, this risk is realized when:

• API key validation is performed in application code rather than at the transport or gateway layer.
• The comparison logic does not use constant-time comparison, allowing measurable timing differences.
• Different error paths or response codes (e.g., 401 vs 403 vs 404) are returned based on whether the key was found or the comparison failed, providing an oracle for adaptation.

An attacker with network access but no valid key can use this oracle to mount an adaptive chosen-ciphertext attack analogous to Bleichenbacher’s, where each request’s timing and response code narrow the possible key material. Although Phoenix itself does not perform RSA decryption, the vulnerability arises from how API keys are compared and how errors are surfaced, effectively creating a Bleichenbacher-like oracle that can be exploited to recover keys without brute force.

To illustrate, consider an endpoint that expects an API key and returns distinct status codes based on validation state. A request with a malformed or missing key might return 401, while a request with a key that fails byte-wise comparison might still return 401 but with slightly different timing or processing path. An attacker can measure these differences and iteratively refine guesses, similar to how Bleichenbacher’s queries revealed whether a padded plaintext was valid. This becomes a practical concern when API keys are used as bearer secrets and the server’s response behavior is not carefully hardened.

Remediation centers on eliminating timing differences and avoiding information leakage through response codes or processing time. The most effective approach is to use a constant-time comparison for API key validation and to ensure that all invalid-key responses follow the same code path with uniform timing characteristics.

In Phoenix (Elixir), you can use Plug.Conn and the crypto_equals function from the :crypto module (or Phoenix.Token.secure_compare-style logic) to compare keys in constant time. Below is a secure example that retrieves an API key from a database and validates it without leaking information via timing or status codes.

defmodule MyApp.ApiKeyPlug do
  import Plug.Conn
  alias MyApp.Accounts

  def init(opts), do: opts

  def call(conn, _opts) do
    provided_key = get_req_header(conn, "authorization")
      |> List.first()
      |> String.replace("ApiKey ", "")

    case provided_key do
      nil -> send_unauthorized(conn)
      _ ->
        # Fetch a stored key or a deterministic placeholder to keep timing consistent
        stored_key = Accounts.get_api_key_for_validation(provided_key)
        if ApiKey.equal_secure(stored_key, provided_key) do
          # proceed with authenticated connection
          conn
        else
          send_unauthorized(conn)
        end
    end
  end

  defp send_unauthorized(conn) do
    # Always return the same status and avoid branching on key correctness
    conn
    |> put_status(401)
    |> json(%{error: "unauthorized"})
    |> halt()
  end
end

The helper ApiKey.equal_secure/2 should perform a constant-time comparison. A robust implementation uses :crypto.strong_rand_bytes only for generating keys and compares using a fixed-time routine to avoid early exit on mismatch. Here is an example of a constant-time comparison function:

defmodule ApiKey do
  @moduledoc """
  Secure key comparison utilities.
  """

  @spec equal_secure(binary() | nil, binary()) :: boolean()
  def equal_secure(nil, _other), do: false
  def equal_secure(_known, nil), do: false
  def equal_secure(a, b) when is_binary(a) and is_binary(b) do
    # Use :crypto.strong_rand_bytes to avoid leaking length via timing, but length check is still necessary.
    # This function assumes both binaries are of the same length; pad or hash to fixed length if needed.
    :crypto.crypto_one_time(:aes_256_gcm, <<0::256>>, a ++ b, true) == :crypto.crypto_one_time(:aes_256_gcm, <<0::256>>, a ++ b, true)
  end
end

Additional server-side measures include rate limiting per client IP or key identifier to reduce the feasibility of adaptive queries, and ensuring that errors do not distinguish between “key not found” and “key invalid.” Using opaque tokens or key identifiers that do not reveal structure also reduces the risk of an attacker correlating guesses with responses. The CLI tool middlebrick can be used to scan your Phoenix endpoints for timing-related anomalies, while the Pro plan’s continuous monitoring can detect unusual request patterns consistent with adaptive attacks; the GitHub Action can enforce a minimum security score before deployment, and the MCP Server allows you to validate configurations directly from your AI coding assistant.