Bleichenbacher Attack in Fiber with Cockroachdb

A Bleichenbacher attack is a practical adaptive chosen-ciphertext attack against asymmetric encryption schemes that use PKCS#1 v1.5 padding, notably RSA. In a web API context, this often manifests when a server decrypts attacker-controlled ciphertext and uses timing differences or error messages to learn information about the plaintext. The combination of Fiber and Cockroachdb can expose this vulnerability when cryptographic operations are performed in application code before database interaction, and error handling or timing behavior leaks decryption outcomes.

Consider a login or token verification flow where a JWT or encrypted session blob is RSA-decoded with a private key stored in application memory. If the application uses a non-constant-time decryption routine and returns distinct errors for padding failures versus other failures, an attacker can iteratively craft ciphertexts and observe timing or status differences. Cockroachdb typically enters the picture as the backend user store where user credentials or encryption metadata are retrieved. If the decryption step occurs before looking up the user in Cockroachdb, the timing discrepancy can be chained: the attacker infers a correct padding structure by measuring response times across decryption attempts, then uses the recovered plaintext (e.g., a recovered password or session key) to authenticate against an endpoint that queries Cockroachdb.

With Fiber, the risk surface is shaped by how routes handle decryption and database calls. For example, an endpoint that accepts an encrypted payload, decrypts it with RSA, and then queries Cockroachdb to fetch a user record can inadvertently create a Bleichenbacher oracle if error handling is not uniform. A typical vulnerable pattern is returning a 400 for decryption errors and a 401 for authentication failures, allowing an attacker to distinguish between padding failures and valid users stored in Cockroachdb. Even without direct database interaction during decryption, timing differences in the crypto layer can be amplified when the subsequent Cockroachdb query behavior is consistent across requests, making the timing signal reliable.

Real-world impact often maps to OWASP API Top 10:2023 broken object level authorization (BOLA) and data exposure, and can intersect with authentication bypass if the recovered secret enables credential forgery. For instance, if the RSA operation recovers a plaintext password or API key, the attacker can use it to impersonate a user and issue SQL queries to Cockroachdb as that user. This is especially relevant when the application uses deterministic encryption or predictable key material, which increases the feasibility of adaptive chosen-ciphertext attacks.

To illustrate in code, a vulnerable Fiber route might look like this, where decryption errors are not uniformly handled before a Cockroachdb lookup:

const crypto = require('crypto');
const { Pool } = require('pg'); // Cockroachdb compatible driver
const fiber = require('fibers');

const pool = new Pool({ connectionString: process.env.COCKROACHDB_URL });

function decryptPrivateKey(encrypted) {
  const privateKey = process.env.RSA_PRIVATE_KEY;
  try {
    return crypto.privateDecrypt({
      key: privateKey,
      padding: crypto.constants.RSA_PKCS1_PADDING,
    }, Buffer.from(encrypted, 'base64'));
  } catch (err) {
    // Distinguishing error types can create an oracle
    if (err.code === 'ERR_OSSL_DECRYPTION_FAILED') {
      throw new Error('Invalid padding');
    }
    throw err;
  }
}

fiber.get('/login', (req, res) => {
  const { token } = req.query;
  let plaintext;
  try {
    plaintext = decryptPrivateKey(token);
  } catch (err) {
    return res.status(400).send({ error: 'decryption_failed' });
  }
  // Query Cockroachdb with the recovered plaintext
  pool.query('SELECT id, password_hash FROM users WHERE api_key = $1', [plaintext.toString()])
    .then(result => {
      if (result.rows.length === 0) {
        return res.status(401).send({ error: 'unauthorized' });
      }
      res.send({ user: result.rows[0].id });
    })
    .catch(dbErr => {
      res.status(500).send({ error: 'db_error' });
    });
});

In this example, a Bleichenbacher attacker can distinguish between padding failures (400) and valid decryption followed by a Cockroachdb miss (401), gradually recovering the plaintext token. The fix requires constant-time decryption and uniform error handling before any database interaction.

Remediation centers on ensuring that decryption does not leak information via timing or error codes, and that database interactions are decoupled from cryptographic operations. Use constant-time comparison for any derived secrets and ensure that all failure paths before Cockroachdb queries return the same status and timing characteristics.

First, refactor decryption to avoid leaking error specifics. Use a constant-time verification approach where possible, and defer database queries until after a successful, uniformly handled decryption.

const crypto = require('crypto');
const { Pool } = require('pg');
const fiber = require('fibers');

const pool = new Pool({ connectionString: process.env.COCKROACHDB_URL });

function safeDecrypt(encrypted) {
  const privateKey = process.env.RSA_PRIVATE_KEY;
  const decipher = crypto.createDecipheriv(
    'aes-256-gcm',
    Buffer.from(process.env.ENC_KEY.slice(0, 32)),
    Buffer.from(process.env.ENC_IV)
  );
  try {
    let decrypted = decipher.update(Buffer.from(encrypted, 'base64'), 'utf8', 'utf8');
    decrypted += decipher.final('utf8');
    const tag = Buffer.from(encryptionTag, 'base64');
    if (!decipher.getAuthTag().equals(tag)) {
      throw new Error('auth-tag-mismatch');
    }
    return decrypted;
  } catch (err) {
    // Always return a generic error to avoid oracle behavior
    throw new Error('invalid_token');
  }
}

fiber.post('/login', (req, res) => {
  const { token } = req.body;
  let plaintext;
  try {
    plaintext = safeDecrypt(token);
  } catch (err) {
    // Uniform error response and status to prevent timing/leak differentiation
    return res.status(400).send({ error: 'invalid_token' });
  }
  // Constant-time comparison placeholder: in practice, use timing-safe compare
  pool.query('SELECT id, password_hash FROM users WHERE api_key = $1', [plaintext])
    .then(result => {
      if (result.rows.length === 0) {
        // Same status as invalid token to avoid user enumeration
        return res.status(400).send({ error: 'invalid_token' });
      }
      // Perform secure session establishment here
      res.send({ user: result.rows[0].id });
    })
    .catch(dbErr => {
      // Log internally, but return generic error to client
      console.error('Cockroachdb query error:', dbErr);
      res.status(400).send({ error: 'invalid_token' });
    });
});

Second, when using RSA, prefer hybrid encryption: encrypt a random symmetric key with RSA, then use AES-GCM for the payload. This reduces the risk of Bleichenbacher-style attacks on RSA PKCS#1 v1.5 and limits the scope of decryption failures.

// Example hybrid approach
const crypto = require('crypto');
const { Pool } = require('pg');
const fiber = require('fibers');

const pool = new Pool({ connectionString: process.env.COCKROACHDB_URL });

function hybridDecrypt(encryptedBlob) {
  const [encKeyB64, ciphertextB64] = encryptedBlob.split('.');
  const privateKey = process.env.RSA_PRIVATE_KEY;
  const encKey = crypto.privateDecrypt({
    key: privateKey,
    padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
  }, Buffer.from(encKeyB64, 'base64'));
  const iv = Buffer.from(ciphertextB64.slice(0, 16), 'hex');
  const decipher = crypto.createDecipheriv('aes-256-gcm', encKey, iv);
  let plaintext = decipher.update(ciphertextB64.slice(16), 'hex', 'utf8');
  plaintext += decipher.final('utf8');
  return plaintext;
}

fiber.post('/login', (req, res) => {
  const { token } = req.body;
  try {
    const plaintext = hybridDecrypt(token);
    pool.query('SELECT id FROM users WHERE api_key = $1', [plaintext])
      .then(result => {
        if (result.rows.length === 0) {
          return res.status(400).send({ error: 'invalid_token' });
        }
        res.send({ user: result.rows[0].id });
      })
      .catch(dbErr => {
        console.error('Cockroachdb error:', dbErr);
        res.status(400).send({ error: 'invalid_token' });
      });
  } catch (err) {
    res.status(400).send({ error: 'invalid_token' });
  }
});

Third, ensure that Cockroachdb queries do not introduce additional side channels. Use parameterized queries consistently and avoid branching on sensitive data. Monitor logs for repeated decryption failures that could indicate an active attack, and consider rate-limiting at the Fiber middleware layer to reduce adaptive attack efficiency.