Padding Oracle in Fastapi with Cockroachdb

A padding oracle attack occurs when an application reveals whether decrypted ciphertext has valid padding, enabling an attacker to recover plaintext without the key. In a Fastapi service that uses Cockroachdb as the backend datastore, this risk arises when cryptographic operations are handled in the application layer and error handling inadvertently exposes padding validation results.

Consider a Fastapi endpoint that accepts an encrypted identifier (for example, a user ID), decrypts it using AES in CBC mode, queries Cockroachdb for a record, and returns data. If the endpoint returns different HTTP statuses or response bodies for invalid padding versus other decryption or database errors, an attacker can iteratively submit modified ciphertexts and observe responses to infer the plaintext.

With Cockroachdb, this becomes a practical concern when encrypted values are stored as BLOBs or base64 strings and are decrypted in Fastapi before use. For instance, an encrypted primary key passed in a URL or header might be decrypted in a route like the following:

from fastapi import FastAPI, HTTPException, Header
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives import padding
import base64
import os

app = FastAPI()

def decrypt_cbc(key, iv, ciphertext_b64):
    ciphertext = base64.b64decode(ciphertext_b64)
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv))
    decryptor = cipher.decryptor()
    padded_plaintext = decryptor.update(ciphertext) + decryptor.finalize()
    unpadder = padding.PKCS7(128).unpadder()
    return unpadder.update(padded_plaintext) + unpadder.finalize()

@app.get("/items/{encrypted_id}")
async def read_item(encrypted_id: str, x_iv: str = Header(None)):
    if not x_iv:
        raise HTTPException(status_code=400, detail="IV required")
    key = os.getenv("ENCRYPTION_KEY")  # 32 bytes for AES-256
    try:
        user_id = decrypt_cbc(key.encode(), x_iv.encode(), encrypted_id)
    except Exception as e:
        raise HTTPException(status_code=400, detail="Decryption error")
    # Cockroachdb query using a secure, parameterized approach is expected here
    # Example placeholder: await crdb_fetch_user(user_id)
    return {"user_id": user_id.decode()}

If the decrypt_cbc function raises distinct exceptions for invalid padding versus other issues, and the Fastapi route maps these to different HTTP status codes or messages, the endpoint acts as a padding oracle. An attacker who can send chosen ciphertexts and observe responses can exploit this to decrypt data or forge valid tokens.

Moreover, if the Fastapi application logs detailed error information and those logs are accessible from Cockroachdb-hosted infrastructure, additional information leakage may occur. The combination of Fastapi’s flexible error handling and Cockroachdb’s role as the data store means that care must be taken to ensure that error responses do not differ based on padding validity, and that decryption errors are handled uniformly.

Remediation focuses on ensuring that padding validation does not leak information and that errors are handled consistently regardless of where they originate (cryptography, database, or input). Below is a secure Fastapi pattern that avoids padding oracle risks while interacting with Cockroachdb.

First, use authenticated encryption (AES-GCM) rather than AES-CBC to avoid padding entirely. If CBC is required for compatibility, validate and handle padding in a constant-time manner and return the same generic error for all failure paths.

Example using AES-GCM with Cockroachdb-stored ciphertexts:

from fastapi import FastAPI, HTTPException, Header
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import os
import base64

app = FastAPI()

def decrypt_gcm(key_b64, nonce_b64, ciphertext_b64, associated_data=None):
    key = base64.b64decode(key_b64)
    nonce = base64.b64decode(nonce_b64)
    ciphertext = base64.b64decode(ciphertext_b64)
    aesgcm = AESGCM(key)
    try:
        plaintext = aesgcm.decrypt(nonce, ciphertext, associated_data)
        return plaintext
    except Exception:
        # Always return the same generic exception to avoid oracle behavior
        raise ValueError("decryption_failed")

@app.get("/items/{encrypted_id}")
async def read_item(encrypted_id: str, x_nonce: str = Header(None), x_ad: str = Header(None)):
    if not x_nonce:
        raise HTTPException(status_code=400, detail="Missing nonce")
    key_b64 = os.getenv("ENCRYPTION_KEY_B64")  # store key securely
    try:
        user_id = decrypt_gcm(key_b64, x_nonce, encrypted_id, base64.b64decode(x_ad) if x_ad else None)
    except ValueError:
        raise HTTPException(status_code=400, detail="Invalid request")
    # Proceed to query Cockroachdb using a safe, parameterized query
    # Example placeholder: user = await crdb_fetch_user_safe(user_id)
    return {"user_id": user_id.decode()}

If CBC mode must be retained, ensure constant-time padding verification and uniform error handling:

import hmac
import secrets
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives import padding

def decrypt_cbc_padded(key, iv, ciphertext_b64):
    ciphertext = base64.b64decode(ciphertext_b64)
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv))
    decryptor = cipher.decryptor()
    padded_plaintext = decryptor.update(ciphertext) + decryptor.finalize()
    try:
        unpadder = padding.PKCS7(128).unpadder()
        plaintext = unpadder.update(padded_plaintext) + unpadder.finalize()
        # Verify integrity with a constant-time check when possible
        return plaintext
    except Exception:
        # Return a generic failure indistinguishable from other errors
        raise ValueError("invalid")

# In Fastapi, ensure all exception paths return the same status and body shape
generic_error = {"error": "invalid_request"}
@app.exception_handler(ValueError)
def handle_value_error(request, exc):
    return JSONResponse(generic_error, status_code=400)

Additionally, store encryption keys outside the application runtime (e.g., via a secrets manager), use parameterized SQL or an ORM when querying Cockroachdb to prevent injection, and ensure all error responses have identical structure and timing characteristics to remove observable differences.