AES-IGE Padding Oracle Attack (CBC-Equivalence)

Updated 13 Sep 2026

• •

  What it is

  • •

    Infinite Garble Extension (IGE) — used by Telegram — decrypts each block as $P_i = D_K(C_i \oplus P_{i-1}) \oplus C_{i-1}$, chaining in both the previous plaintext and previous ciphertext block (seeded by two IV-like values, $m_0$ and $c_0$​, for the first block). With $P_{i-1}$​ (or $m_0$​) fixed and known, this formula has exactly the same shape as ordinary CBC decryption, with $C_{i-1}$​ (or $c_0$​) playing the role of the IV — so the standard CBC padding-oracle byte-recovery technique applies directly, just forging bytes of $c_0$​ instead of an IV.

• •

  When to apply

  • •

    A service uses AES-IGE and its decryption endpoint reveals whether decrypted plaintext had valid padding, and you know (or control) the "previous plaintext" seed value $m_0$/$P_{i-1}$​ for the block you're attacking.

• •

  Math

  • •

    $P_i​ = D_K​(C_i \oplus P_{i−1}​) \oplus C_{i−1}​$. With $P_{i-1}$​ fixed and known, forging $C_{i-1}$​ byte-by-byte to hit each target padding value recovers $P_i$​ exactly the same way forging a CBC IV does.

• •

  Worked example

  • •

    Attacking the first block (where $m_0$​ and $c_0$​ are returned directly by the server) recovered crypto{dumm byte-by-byte. The second block was then attacked using the first block's recovered plaintext as the new $m_0$​ and the first block's real ciphertext as the new $c_0$​ — chaining the technique block-by-block through the whole message to complete the flag, crypto{dummy_flag}.

• •

  Python

  • •

    # structurally identical to the CBC padding-oracle recover_block(), except
    # "prev_block" is played by c0 (or C_{i-1}), and the oracle call must also
    # supply the fixed m0 (or P_{i-1}) alongside the crafted c0
    def recover_block(oracle, m0, c0, target_block):
        recovered = bytearray(16)
        crafted = bytearray(c0)
        for idx in range(15, -1, -1):
            pad = 16 - idx
            for j in range(15, idx, -1):
                crafted[j] = c0[j] ^ recovered[j] ^ pad
            for guess in range(256):
                crafted[idx] = c0[idx] ^ guess ^ pad
                if oracle(target_block, m0, bytes(crafted)):
                    recovered[idx] = guess
                    break
        return bytes(recovered)
    

• •

  Related

  • •

    CBC Padding Oracle Attack (Vaudenay)

• •

  Cards

  • •

    What makes IGE mode vulnerable to the same attack as CBC, despite chaining differently?

    • •

      When the "previous plaintext" input is fixed/known, IGE's single-block decryption formula has exactly the same algebraic shape as CBC decryption, with the "previous ciphertext" playing the role of the IV.

  • •

    What two values do you need to chain the attack from one IGE block to the next?

    • •

      The previous block's recovered plaintext (as the new m0) and the previous block's real ciphertext (as the new c0).

◌ Explore connections in Graph view