Adaptive chosen ciphertext attack

An adaptive chosen ciphertext attack is a form of chosen ciphertext attack in which an attacker attack sends a large number of ciphertexts to be decrypted, using the results of these decryptions to select subsequent ciphertexts. The goal of this attack is to gradually reveal information about an encrypted message, or about the decryption key itself. Adaptive chosen ciphertexts are generally applicable only to public-key cryptosystems that have the property of ciphertext malleability-- that is, a ciphertext can be modified in specific ways that will have a predictable effect on the decryption of that message.

Practical Attacks

Until recently, adaptive chosen ciphertext attacks were largely considered to be a theoretical concern. In 1998, Daniel Bleichenbacher of Bell Laboratories demonstrated a practical attack against systems using RSA encryption in concert with the PKCS #1 v1 encoding function, including a version of the Secure Socket Layer (SSL) Protocol used by thousands of web servers at the time.

The Bleichenbacher attacks took advantage of flaws within the PKCS #1 function to gradually reveal the content of an RSA encrypted message. Doing this requires sending several million test ciphertexts to the decryption device (eg, SSL-equipped web server.) In practical terms, this means that an SSL session key can be exposed in a reasonable amount of time, perhaps a day or less.

Preventing Attacks

In order to prevent adaptive chosen ciphertext attacks, it is necessary to use an encryption or encoding scheme that limits ciphertext malleability. A number of encoding schemes have been proposed; the most common standard for RSA encryption is Optimal Asymmetric Encryption Padding (OAEP). Unlike ad-hoc schemes such as the padding used in PKCS #1 v1, OAEP is provably secure under the random oracle model.