Padding Oracle in Aspnet with Dynamodb

A Padding Oracle in an ASP.NET application that uses Amazon DynamoDB as a persistence store typically arises from two conditions: (1) the application decrypts attacker-controlled data and uses padding validation errors as a side-channel, and (2) the DynamoDB data store is used to persist ciphertexts or related metadata that an attacker can influence. In this setup, an attacker can supply modified ciphertexts (e.g., by tampering with a cookie, query parameter, or API payload) and observe whether the server responds with distinct padding errors versus other errors. These behavioral differences constitute an oracle that enables recovery of plaintext without knowing the key.

Consider an ASP.NET endpoint that stores user session data as an encrypted blob in DynamoDB. The client receives an encrypted identifier, which the server retrieves, decrypts, and validates. If the decryption uses a mode such as CBC without proper integrity protection, and the server distinguishes between a padding error and a generic decryption or validation failure, an attacker can iteratively modify bytes in the ciphertext stored in DynamoDB or supplied in transit to learn the plaintext. Because DynamoDB holds the ciphertext, an attacker may not need direct access to the database—tampering can occur in transit or via manipulated client-side values that reference a DynamoDB item.

In practice, this manifests when an ASP.NET app deserializes or decrypts data retrieved from DynamoDB and processes it in a way that reveals padding validation outcomes. For example, an endpoint might decrypt a value, attempt to parse structured data (like JSON), and return different HTTP statuses or messages depending on whether padding removal succeeds. These differences are detectable by an attacker conducting a remote padding oracle attack, even though the sensitive data resides in or is influenced by DynamoDB records.

Remediation focuses on eliminating padding as an oracle and ensuring that operations on DynamoDB-stored ciphertexts do not expose distinct error paths. Use authenticated encryption with associated data (AEAD) such as AES-GCM instead of raw CBC, and avoid returning distinguishable errors for padding versus other failures. Always use constant-time comparisons and handle decryption errors generically.

Example: Secure decryption with AES-GCM and DynamoDB in ASP.NET

The following C# example shows how to store and retrieve encrypted data in DynamoDB using AES-GCM, avoiding padding issues entirely. It uses the AWS SDK for .NET and cryptography APIs available in .NET 6+.

using System;
using System.IO;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using Amazon.DynamoDBv2;
using Amazon.DynamoDBv2.DataModel;

public class SecureRecord
{
    public string Id { get; set; }
    public byte[] Ciphertext { get; set; }
    public byte[] Nonce { get; set; }
    public byte[] Tag { get; set; } // GCM authentication tag
}

public class SecureRepository
{
    private readonly IAmazonDynamoDB _dynamo;
    private readonly string _key; // 256-bit key managed securely, e.g., from Azure Key Vault or AWS KMS

    public SecureRepository(IAmazonDynamoDB dynamo, string keyBase64)
    {
        _dynamo = dynamo;
        _key = keyBase64;
    }

    public async Task StoreAsync(string id, string plaintext)
    {
        var key = Convert.FromBase64String(_key);
        var nonce = new byte[12]; // 96-bit nonce for GCM
        using var rng = RandomNumberGenerator.Create();
        rng.GetBytes(nonce);

        using var aes = new AesGcm(key);
        var plainBytes = Encoding.UTF8.GetBytes(plaintext);
        var ciphertext = new byte[plainBytes.Length];
        var tag = new byte[16]; // GCM tag size

        aes.Encrypt(nonce, plainBytes, ciphertext, tag);

        var record = new SecureRecord
        {
            Id = id,
            Ciphertext = ciphertext,
            Nonce = nonce,
            Tag = tag
        };

        var config = new DynamoDBContext(_dynamo);
        await config.SaveAsync(record);
    }

    public async Task RetrieveAsync(string id)
    {
        var config = new DynamoDBContext(_dynamo);
        var record = await config.LoadAsync<SecureRecord>(id);
        if (record == null) throw new InvalidOperationException("Item not found");

        var key = Convert.FromBase64String(_key);
        using var aes = new AesGcm(key);
        var plainBytes = new byte[record.Ciphertext.Length];

        try
        {
            aes.Decrypt(record.Nonce, record.Ciphertext, record.Tag, plainBytes);
        }
        catch (CryptographicException)
        {
            // Generic error; do not reveal padding or decryption specifics
            throw new InvalidOperationException("Invalid data");
        }

        return Encoding.UTF8.GetString(plainBytes);
    }
}

If you must use CBC (e.g., legacy constraints), ensure decryption errors are handled uniformly and never expose padding errors. Use HMAC to verify integrity before decryption, and employ constant-time logic to avoid branching on sensitive data.

Example: Safe error handling with CBC and HMAC

using System;
using System.Linq;
using Amazon.DynamoDBv2.DataModel;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;

public class CbcWithMacRecord
{
    public string Id { get; set; }
    public byte[] Ciphertext { get; set; }
    public byte[] Iv { get; set; }
    public byte[] Mac { get; set; }
}

public class CbcSecureRepository
{
    private readonly IAmazonDynamoDB _dynamo;
    private readonly byte[] _key; // encryption key
    private readonly byte[] _macKey; // separate MAC key

    public CbcSecureRepository(IAmazonDynamoDB dynamo)
    {
        _dynamo = dynamo;
        // In practice, derive keys securely; this is illustrative.
        _key = Convert.FromBase64String(Environment.GetEnvironmentVariable("ENC_KEY"));
        _macKey = Convert.FromBase64String(Environment.GetEnvironmentVariable("MAC_KEY"));
    }

    public async Task StoreAsync(string id, string plaintext)
    {
        var iv = RandomBytes(16);
        var ciphertext = AesCbcEncrypt(plaintext, _key, iv);
        var mac = ComputeMac(ciphertext, iv, _macKey);

        var record = new CbcWithMacRecord
        {
            Id = id,
            Ciphertext = ciphertext,
            Iv = iv,
            Mac = mac
        };

        var config = new DynamoDBContext(_dynamo);
        await config.SaveAsync(record);
    }

    public async Task RetrieveAsync(string id)
    {
        var config = new DynamoDBContext(_dynamo);
        var record = await config.LoadAsync<CbcWithMacRecord>(id);
        if (record == null) throw new InvalidOperationException("Item not found");

        if (!VerifyMac(record.Ciphertext, record.Iv, record.Mac, _macKey))
        {
            throw new InvalidOperationException("Invalid data");
        }

        try
        {
            return AesCbcDecrypt(record.Ciphertext, _key, record.Iv);
        }
        catch
        {
            // Always throw a generic error to avoid leaking padding or decryption details
            throw new InvalidOperationException("Invalid data");
        }
    }

    private static byte[] RandomBytes(int length)
    {
        var bytes = new byte[length];
        using var rng = RandomNumberGenerator.Create();
        rng.GetBytes(bytes);
        return bytes;
    }

    private static byte[] ComputeMac(byte[] ciphertext, byte[] iv, byte[] key)
    {
        using var hmac = new HMACSHA256(key);
        using var ms = new MemoryStream();
        ms.Write(iv);
        ms.Write(ciphertext);
        return hmac.ComputeHash(ms.GetBuffer(), 0, (int)ms.Position);
    }

    private static bool VerifyMac(byte[] ciphertext, byte[] iv, byte[] mac, byte[] key)
    {
        var computed = ComputeMac(ciphertext, iv, key);
        return computed.SequenceEqual(mac);
    }

    private static byte[] AesCbcEncrypt(string plainText, byte[] key, byte[] iv)
    {
        using var aes = Aes.Create();
        aes.Key = key;
        aes.IV = iv;
        aes.Mode = CipherMode.CBC;
        aes.Padding = PaddingMode.PKCS7;

        using var encryptor = aes.CreateEncryptor();
        using var ms = new MemoryStream();
        using (var cs = new CryptoStream(ms, encryptor, CryptoStreamMode.Write))
        using (var sw = new StreamWriter(cs))
        {
            sw.Write(plainText);
        }
        return ms.ToArray();
    }

    private static string AesCbcDecrypt(byte[] ciphertext, byte[] key, byte[] iv)
    {
        using var aes = Aes.Create();
        aes.Key = key;
        aes.IV = iv;
        aes.Mode = CipherMode.CBC;
        aes.Padding = PaddingMode.PKCS7;

        using var decryptor = aes.CreateDecryptor();
        using var ms = new MemoryStream(ciphertext);
        using var cs = new CryptoStream(ms, decryptor, CryptoStreamMode.Read);
        using var sr = new StreamReader(cs);
        return sr.ReadToEnd();
    }
}

Key takeaways: prefer AEAD modes; if using CBC, verify integrity before decryption and return only generic errors; store ciphertext and nonce/tag as separate DynamoDB attributes to avoid ambiguity; ensure keys are managed securely and not hard-coded.