Poodle Attack in Fiber with Hmac Signatures

The Poodle (Padding Oracle On Downgraded Legacy Encryption) attack targets cryptographic implementations that use block ciphers in CBC mode and do not properly verify integrity before decryption. When an API endpoint implemented in Fiber uses Hmac Signatures only for authentication but does not enforce integrity protection of the ciphertext or does not use an AEAD cipher, it can become vulnerable to padding oracle attacks if error messages or behavior differ based on padding validity.

Consider a scenario where a Fiber server accepts an encrypted JWT or session token, verifies an Hmac signature to confirm authenticity, then decrypts using CBC without checking padding integrity in a constant-time manner. If the server returns distinct errors for "invalid signature" versus "invalid padding," an attacker can perform a byte-by-byte padding oracle attack. By observing HTTP status codes or response times, the attacker can iteratively decrypt or forge plaintext without knowing the key, despite the presence of Hmac Signatures.

In the context of middleBrick scans, this is surfaced under the Input Validation and Authentication checks. The scanner detects whether endpoints reveal timing differences or distinct error messages when tampering with encrypted payloads that include Hmac Signatures. Even when Hmac Signatures are present, if they are verified before proper decryption and padding checks, the API surface remains exposed to Poodle-style attacks. This is especially relevant when legacy support or interoperability requirements encourage CBC-mode usage alongside Hmac Signatures rather than AEAD modes like AES-GCM.

Real-world findings from middleBrick include cases where an API endpoint in Fiber used Hmac Signatures to authenticate requests but accepted encrypted CBC payloads with no associated AEAD metadata. The scanner observed that error handling leaked padding validity through status codes, enabling an attacker to mount a practical padding oracle attack. Since the scanner tests unauthenticated attack surfaces, it can identify these leakage vectors without credentials, emphasizing the need to align Hmac Signatures usage with safe cryptographic primitives and constant-time verification.

To mitigate Poodle-style attacks while using Hmac Signatures in Fiber, ensure that you either use authenticated encryption with associated data (AEAD) or, if CBC is required, you verify integrity before decryption and use constant-time padding checks. Below are concrete examples that demonstrate secure handling in Fiber.

Example 1: Using AES-GCM (recommended)

Replace CBC with AEAD so that decryption either succeeds or fails cleanly, with no padding oracle.

import { Router } from "https://deno.land/x/fiber@v2.0.0/mod.ts";
import { createDecipheriv, createVerify, timingSafeEqual } from "https://deno.land/std@0.224.0/crypto/mod.ts";

const router = new Router();
const KEY = new TextEncoder().encode(Deno.env.get("AES_KEY") || "".padEnd(32, "0").slice(0, 32));
const IV = new TextEncoder().encode("1234567890123456"); // In practice, use a random IV per message and transmit it safely

router.post("/secure", (c) => {
  const received = c.request.body({ type: "json" });
  const ciphertext = received.value.ciphertext; // Uint8Array
  const receivedTag = received.value.tag; // Uint8Array(16)
  const receivedHmac = received.value.hmac; // Uint8Array

  // First: verify Hmac over ciphertext + tag
  const keyMaterial = new TextEncoder().encode("hmac-key-here");
  const hmac = new Uint8Array(receivedHmac.length);
  // crypto.subtle.importKey and sign omitted for brevity; assume hmac verified with timingSafeEqual

  // Then: decrypt with AES-GCM
  const aes = new CryptoKey(); // imported key
  const dec = new Uint8Array(ciphertext.length);
  try {
    const aesKey = await crypto.subtle.importKey("raw", KEY, { name: "AES-GCM" }, false, ["decrypt"]);
    const plain = await crypto.subtle.decrypt({ name: "AES-GCM", iv: IV, additionalData: new Uint8Array() }, aesKey, ciphertext);
    c.status(200).send({ data: plain });
  } catch (err) {
    // Generic error; do not distinguish padding vs auth failures
    c.status(400).send({ error: "invalid message" });
  }
});

Example 2: If you must use CBC, verify integrity before decryption and use constant-time comparison

This pattern verifies an Hmac over the ciphertext first, then decrypts with CBC using a constant-time padding check to avoid oracle behavior.

import { Router } from "https://deno.land/x-fiber@v2.0.0/mod.ts";
import { Hmac, sha256 } from "https://deno.land/std@0.224.0/crypto/hash/hmac.ts";
import { assertEquals } from "https://deno.land/std@0.224.0/testing/asserts.ts";

const router = new Router();
const HMAC_KEY = new TextEncoder().encode("hmac-secret");

function verifyConstantTime(a: Uint8Array, b: Uint8Array): boolean {
  if (a.length !== b.length) {
    return false;
  }
  let result = 0;
  for (let i = 0; i < a.length; i++) {
    result |= a[i] ^ b[i];
  }
  return result === 0;
}

router.post("/legacy-cbc", (c) => {
  const body = c.request.body({ type: "json" });
  const ciphertext = body.value.ciphertext; // Uint8Array
  const receivedHmac = body.value.hmac; // Uint8Array

  // Verify Hmac over ciphertext
  const mac = new Hmac(sha256, HMAC_KEY);
  mac.update(ciphertext);
  const expectedHmac = mac.digest();

  if (!verifyConstantTime(expectedHmac, receivedHmac)) {
    c.status(401).send({ error: "authentication failed" });
    return;
  }

  // Now decrypt with CBC and handle padding in constant time
  const key = new TextEncoder().encode(Deno.env.get("CBC_KEY") || "".padEnd(32, "0").slice(0, 32));
  const iv = new TextEncoder().encode("1234567890123456");
  try {
    // In a real implementation, use a Crypto library that supports CBC with PKCS7 and constant-time unpad
    // For illustration, we assume a safeDecryptCbc function that does not leak padding errors
    const plaintext = safeDecryptCbcConstantTime(key, iv, ciphertext); // custom or vetted implementation
    c.status(200).send({ data: plaintext });
  } catch (err) {
    // Generic error to avoid distinguishing padding failures
    c.status(400).send({ error: "invalid message" });
  }
});

Remediation checklist specific to Hmac Signatures

• Always verify integrity (Hmac) before attempting decryption, and ensure verification uses constant-time comparison to prevent timing leaks.
• Prefer AEAD modes (AES-GCM, ChaCha20-Poly1305) over CBC+Hmac to eliminate padding oracle risks.
• Ensure error messages do not differentiate between padding failures and signature failures; use a uniform error response.
• Rotate Hmac keys and encryption keys independently and follow key management best practices.
• If using OpenAPI/Swagger, document the cryptographic expectations clearly so that runtime findings from middleBrick align with implementation intent.

These steps reduce the risk that Hmac Signatures coexist with a padding oracle vector, aligning the implementation with secure cryptographic engineering and reducing the attack surface that middleBrick would flag.