Padding Oracle in Chi with Dynamodb

A Padding Oracle in the context of Chi using Amazon DynamoDB typically arises when an application encrypts data client-side before storing it in DynamoDB, then reveals information about the validity of padding during decryption. If the application returns distinct error messages or timing differences for invalid padding versus other decryption failures, an attacker can iteratively submit modified ciphertexts and observe responses to gradually recover plaintext without needing the key.

Consider a Chi service that stores sensitive user profiles as encrypted items in a DynamoDB table. The service encrypts JSON attributes (e.g., email, role) with AES-CBC, stores the base64-encoded ciphertext in a DynamoDB attribute, and later retrieves and decrypts it. If the decryption routine in Chi does not use constant-time padding removal and instead relies on standard library checks that throw different exceptions for bad padding versus malformed data, the endpoint becomes an oracle. An attacker who can intercept or manipulate ciphertexts (e.g., by tampering with a token stored in DynamoDB) can send crafted requests to the Chi endpoint and infer padding validity byte by byte, eventually revealing the plaintext.

DynamoDB itself does not introduce padding issues; the risk comes from how Chi processes and returns data from the table. Because DynamoDB is often used as a backend for session or token storage, a compromised ciphertext item in the table combined with a padding-oracle-prone decryption flow in Chi can enable offline decryption of other items. This is especially relevant when items are encrypted with static or poorly managed keys, or when the same key is used across multiple services. The unauthenticated scan capability of middleBrick can detect endpoints in Chi that expose timing discrepancies or specific error messages correlated with padding errors, surfacing the vulnerability even without credentials.

Real-world patterns include endpoints that decrypt ID tokens or JWTs stored in DynamoDB and return 400 for bad padding versus 401 for invalid signatures. The presence of items encrypted with algorithms like AES-CBC in DynamoDB, combined with verbose error handling in Chi, maps to findings aligned with OWASP API Top 10:2023 Broken Object Level Authorization and relevant PCI-DSS control requirements. middleBrick’s 12 checks run in parallel and can surface such risky endpoint behaviors by analyzing unauthenticated responses and spec-defined error paths.

To remediate Padding Oracle risks in Chi when using DynamoDB, ensure decryption in Chi uses constant-time padding validation and returns uniform error responses regardless of padding or decryption failures. Avoid branching logic that exposes internal states to the client, and treat all decryption failures as generic authentication or integrity errors.

Below is a Chi endpoint example before and after remediation. The vulnerable code uses standard Clojure data handling with an AES decryption helper that throws distinct exceptions for padding errors, which can be leveraged as an oracle.

(ns vulnerable-chi.handler
  (:require [cheshire.core :as json]
            [clj-http.client :as http]))

(defn decrypt-cbc [bytes key iv]
  (let [cipher (javax.crypto.Cipher/getInstance "AES/CBC/PKCS5Padding")
        spec (javax.crypto.spec.IvParameterSpec. iv)
        k (.generateKey (javax.crypto.spec.SecretKeySpec. key "AES"))]
    (.doFinal cipher (javax.crypto.Cipher/DECRYPT_MODE) k spec)))

(defn get-profile [req]
  (let [id (:id req)
        item (dynamo/get-item {:table "profiles" :key {:id id}})
        ciphertext (:encrypted-data item)
        plaintext (decrypt-ciphertext ciphertext (:enc-key item))]
    (json/generate-string plaintext)))

The fix uses a constant-time comparison approach and ensures that any decryption or padding error results in a generic response. Below is a hardened version that avoids leaking padding errors and uses uniform error handling.

(ns hardened-chi.handler
  (:require [cheshire.core :as json]
            [clojure.string :as str]
            [clj-http.client :as http]))

(defn constant-time-decrypt [bytes key iv]
  (let [cipher (javax.crypto.Cipher/getInstance "AES/CBC/PKCS5Padding")
        spec (javax.crypto.spec.IvParameterSpec. iv)
        k (.generateKey (javax.crypto.spec.SecretKeySpec. key "AES"))]
    (try
      (.doFinal cipher (javax.crypto.Cipher/DECRYPT_MODE) k spec)
      (catch javax.crypto.BadPaddingException e
        (throw (ex-info "decryption_failed" {:type :generic})))))

(defn safe-decrypt [ciphertext key iv]
  (try
    (constant-time-decrypt ciphertext key iv)
    (catch Exception _
      (throw (ex-info "decryption_failed" {:type :generic})))))

(defn get-profile [req]
  (let [id (:id req)
        item (dynamo/get-item {:table "profiles" :key {:id id}})
        ciphertext (:encrypted-data item)]
    (try
      (let [plaintext (safe-decrypt ciphertext (:enc-key item) (:iv item))]
        (json/generate-string plaintext))
      (catch Exception _
        (http/response {:error "Unauthorized"}) :status 401))))

Additionally, prefer authenticated encryption (e.g., AES-GCM) where available, rotate keys, and avoid storing static keys alongside data in DynamoDB. middleBrick can validate that your endpoints no longer expose padding-related timing or error differences by scanning Chi deployments and mapping findings to frameworks such as OWASP API Top 10 and GDPR.