Padding Oracle in Echo Go with Dynamodb

A padding oracle arises when an application reveals whether decrypted data is valid during an error-based decryption feedback loop. In Echo Go, using the AWS SDK for Go to interact with DynamoDB can inadvertently create a padding oracle if encrypted items stored in DynamoDB are decrypted in the handler and the application returns different HTTP statuses or messages depending on whether the padding is correct.

Consider an Echo Go route that reads an encrypted object from DynamoDB using a key derived from a user-supplied identifier or token. If the application uses AES in CBC mode and calls cipher.NewCBCDecrypter without proper integrity verification, any invalid padding bytes will cause a Go error. If the handler returns a 400 with "invalid padding" versus a 401 with "authentication failed", an attacker can use these observable differences as an oracle to iteratively decrypt ciphertext without knowing the key. This becomes worse when the ciphertext is stored as an item attribute in DynamoDB and the item metadata (such as version or checksum) is used to decide the type of error response, unintentionally coupling storage format to error behavior.

DynamoDB itself does not introduce the padding oracle; the risk comes from how Echo Go processes and responds to decryption results. For example, if you store a JSON document encrypted with a data key and later decrypt it to validate a field, returning distinct HTTP codes based on padding correctness allows an attacker to submit manipulated ciphertexts and observe differences. Over time, this permits recovery of plaintext byte-by-byte, especially when combined with patterns like versioned attributes or conditional expression checks in DynamoDB that change the response path in Go handlers.

Best practice is to avoid branching logic on padding errors in Echo Go. Use authenticated encryption (such as AES-GCM) or an encrypt-then-MAC approach, and ensure that any decryption routine returns a uniform error response regardless of failure cause. In the context of DynamoDB, this means designing your Go service to catch all decryption and unmarshaling errors and respond with a generic 400 or 401, preventing any information leak about padding validity through status codes or body content.

To remediate padding oracle risks when using DynamoDB in Echo Go, adopt authenticated encryption and ensure consistent error handling. Below are concrete, working examples that show how to store and retrieve encrypted data safely.

1. Use AES-GCM instead of CBC

GCM provides confidentiality and integrity in one step, eliminating padding entirely. This example encrypts a JSON payload before storing it in DynamoDB and decrypts it when reading, with uniform error handling in Echo Go.

// encrypt_store.go
package main

import (
	"context"
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"encoding/base64"
	"encoding/json"
	"errors"
	"io"

	"github.com/aws/aws-sdk-go-v2/aws"
	"github.com/aws/aws-sdk-go-v2/config"
	"github.com/aws/aws-sdk-go-v2/service/dynamodb"
	"github.com/aws/aws-sdk-go-v2/service/dynamodb/types"
	"github.com/labstack/echo/v4"
)

type SecureItem struct {
	ID       string `json:"id"`
	Cipher   string `json:"cipher"`   // base64 GCM ciphertext
	Nonce    string `json:"nonce"`    // base64 nonce
	Tag      string `json:"tag""      // base64 auth tag
}

func encryptAndStore(c echo.Context) error {
	e := c.Request().Context()
	key := c.Param("key")
	payload := map[string]string{"data": "sensitive"}
	plaintext, _ := json.Marshal(payload)

	k := []byte("examplekey1234567") // 128-bit key; use KMS in production
	block, _ := aes.NewCipher(k)
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return echo.NewHTTPError(500, "internal error")
	}
	nonce := make([]byte, gcm.NonceSize())
	if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
		return echo.NewHTTPError(500, "internal error")
	}
	ciphertext := gcm.Seal(nil, nonce, plaintext, nil)

	item := SecureItem{
		ID:     key,
		Cipher: base64.StdEncoding.EncodeToString(ciphertext),
		Nonce:  base64.StdEncoding.EncodeToString(nonce),
		Tag:    base64.StdEncoding.EncodeToString(ciphertext[len(ciphertext)-gcm.Overhead():]),
	}
	body, _ := json.Marshal(item)

	cfg, _ := config.LoadDefaultConfig(e)
	ddb := dynamodb.NewFromConfig(cfg)
	_, err = ddb.PutItem(e, &dynamodb.PutItemInput{
		TableName: aws.String("SecureTable"),
		Item: map[string]types.AttributeValue{
			"id":     &types.AttributeValueMemberS{Value: item.ID},
			"cipher": &types.AttributeValueMemberS{Value: item.Cipher},
			"nonce":  &types.AttributeValueMemberS{Value: item.Nonce},
			"tag":    &types.AttributeValueMemberS{Value: item.Tag},
		},
	})
	if err != nil {
		return echo.NewHTTPError(500, "storage error")
	}
	return c.JSON(200, map[string]string{"status": "ok"})
}

func retrieveDecrypt(c echo.Context) error {
	e := c.Request().Context()
	key := c.Param("key")

	cfg, _ := config.LoadDefaultConfig(e)
	ddb := dynamodb.NewFromConfig(cfg)
	out, err := ddb.GetItem(e, &dynamodb.GetItemInput{
		TableName: aws.String("SecureTable"),
		Key: map[string]types.AttributeValue{
			"id": &types.AttributeValueMemberS{Value: key},
		},
	})
	if err != nil || out.Item == nil {
		return echo.NewHTTPError(404, "not found")
	}

	var item SecureItem
	if err := json.Unmarshal([]aws.ToString(out.Item["cipher"]), &item); err != nil {
		return echo.NewHTTPError(400, "invalid data")
	}
	ciphertext, _ := base64.StdEncoding.DecodeString(item.Cipher)
	nonce, _ := base64.StdEncoding.DecodeString(item.Nonce)
	// tag handling omitted for brevity; in practice verify before Open

	block, _ := aes.NewCipher([]byte("examplekey1234567"))
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return echo.NewHTTPError(400, "invalid data")
	}
	plaintext, err := gcm.Open(nil, nonce, ciphertext, nil)
	if err != nil {
		return echo.NewHTTPError(400, "invalid data")
	}
	var payload map[string]string
	json.Unmarshal(plaintext, &payload)
	return c.JSON(200, payload)
}
"

2. Centralized error handling in Echo Go

Ensure that all decryption and DynamoDB errors result in the same HTTP response to prevent information leakage. Use a helper to wrap failures uniformly.

// middleware.go
package main

import (
	"github.com/labstack/echo/v4"
	"github.com/labstack/echo/v4/middleware"
)

func secureErrorMiddleware() echo.MiddlewareFunc {
	return middleware.CustomErrorHandler(func(err error, c echo.Context) {
		c.Response().Status = 400
		c.Response().Header().Set("Content-Type", "application/json")
		c.Response().Write([]byte(`{"error":"invalid request"}`))
	})
}

// In main.go
// e := echo.New()
// e.Use(secureErrorMiddleware())
// e.POST("/store/:key", encryptStore)
// e.GET("/get/:key", retrieveDecrypt)

3. DynamoDB conditional checks without branching on padding

When using DynamoDB expressions, avoid returning different error paths based on validation. Process all failures through a single error channel in Echo Go.

// Example expression with uniform error path
input := &dynamodb.GetItemInput{
	TableName: aws.String("Items"),
	Key: map[string]types.AttributeValue{
		"id": &types.AttributeValueMemberS{Value: key},
	},
	ProjectionExpression: aws.String("cipher,nonce"),
}
result, err := ddb.GetItem(ctx, input)
if err != nil || result.Item == nil {
	// Always return the same error shape to the client
	return echo.NewHTTPError(400, "invalid")
}