Bleichenbacher Attack in Hapi with Dynamodb

A Bleichenbacher attack is a chosen-ciphertext attack against asymmetric encryption schemes that use PKCS#1 v1.5 padding. In a Hapi application that stores encrypted data or signatures in DynamoDB, this combination can expose a side-channel through error differentiation. When Hapi uses RSA-OAEP or RSA-PKCS1-v1_5 operations and the application returns distinct error messages or timing differences depending on whether a padding check fails, an attacker can iteratively send modified ciphertexts and observe responses to gradually decrypt data or recover the private key.

DynamoDB itself does not introduce the cryptographic weakness, but the way Hapi interacts with DynamoDB can amplify the risk. For example, if Hapi stores ciphertexts as item attributes and later retrieves them for decryption, an attacker who can trigger decryption operations (e.g., via an unauthenticated endpoint that processes stored blobs) can use timing variance between valid and invalid padding errors to perform the Bleichenbacher adaptive chosen-ciphertext procedure. If Hapi does not enforce constant-time padding validation and does not use authenticated encryption (AEAD), the DynamoDB read path becomes a useful oracle for the attacker.

Consider a scenario where Hapi exposes an endpoint that retrieves an encrypted document from DynamoDB and attempts to decrypt it for a user. If the endpoint responds with different HTTP statuses or response bodies for decryption failures (e.g., 400 vs 401) or exhibits measurable timing differences, an attacker can automate requests that narrow down the plaintext without ever having access to the key. This is especially relevant when the same endpoint is used in unauthenticated attack surface scans: an attacker can probe the endpoint with manipulated ciphertexts and observe whether DynamoDB retrieval succeeds and whether decryption proceeds to the padding check stage.

Real-world impact includes recovery of session tokens, private keys, or other sensitive data encrypted with the vulnerable key. In the context of OWASP API Top 10, this aligns with 'Broken Object Level Authorization' and 'Security Misconfiguration' when encryption is implemented without proper safeguards. A related concern is the lack of authenticated encryption, which means integrity is not guaranteed and ciphertext malleability can be exploited alongside padding oracle behavior.

Using middleBrick’s LLM/AI Security checks, you can detect whether your API endpoints expose timing or error-difference side channels that could aid a Bleichenbacher-style oracle. Its active prompt injection testing and system prompt leakage detection are designed for AI endpoints, but the scanner also flags risky patterns in API behavior that might simplify oracle-assisted attacks. The scan runs in 5–15 seconds, providing per-category breakdowns and prioritized findings with remediation guidance, so you can identify whether your DynamoDB-integrated Hapi endpoints inadvertently assist an attacker.

To mitigate Bleichenbacher-style attacks in a Hapi service that uses DynamoDB, ensure cryptographic operations are constant-time and use authenticated encryption. Avoid returning distinguishable errors for padding failures, and do not let DynamoDB retrieval influence cryptographic behavior. Instead of decrypting raw ciphertexts retrieved from DynamoDB with a detectable oracle, validate integrity before decryption and use AEAD ciphers where possible.

Below are concrete Node.js examples using the AWS SDK v3 for DynamoDB and Node’s crypto module. These snippets assume you have an Hapi server and want to store and retrieve encrypted data safely.

1. Use authenticated encryption (AES-GCM) instead of RSA PKCS1 v1.5

Prefer symmetric authenticated encryption for data at rest. If you must use RSA, prefer RSA-OAEP and never use PKCS1 v1.5 for new designs.

const { DynamoDBClient, PutItemCommand, GetItemCommand } = require('@aws-sdk/client-dynamodb');
const { marshall, unmarshall } = require('@aws-sdk/util-dynamodb');
const crypto = require('crypto');

const client = new DynamoDBClient({ region: 'us-east-1' });

async function storeEncryptedItem(tableName, id, plaintext, encryptionKey) {
  const iv = crypto.randomBytes(12);
  const cipher = crypto.createCipheriv('aes-256-gcm', encryptionKey, iv);
  let ciphertext = cipher.update(plaintext, 'utf8');
  ciphertext = Buffer.concat([ciphertext, cipher.final()]);
  const authTag = cipher.getAuthTag();

  const params = {
    TableName: tableName,
    Item: marshall({
      id: { S: id },
      iv: { B: iv },
      ciphertext: { B: ciphertext },
      authTag: { B: authTag }
    })
  };
  await client.send(new PutItemCommand(params));
}

async function retrieveAndDecryptItem(tableName, id, encryptionKey) {
  const params = {
    TableName: tableName,
    Key: marshall({ id: { S: id } })
  };
  const { Item } = await client.send(new GetItemCommand(params));
  const item = unmarshall(Item);

  const { iv, ciphertext, authTag } = item;
  const decipher = crypto.createDecipheriv('aes-256-gcm', encryptionKey, iv);
  decipher.setAuthTag(authTag);
  let plaintext = decipher.update(ciphertext);
  plaintext = Buffer.concat([plaintext, decipher.final()]);
  return plaintext.toString('utf8');
}

// Usage in Hapi handler
const handler = async (request, h) => {
  const key = crypto.randomBytes(32); // store this securely, e.g., from a KMS
  await storeEncryptedItem('MyTable', 'user123', 'secret', key);
  const restored = await retrieveAndDecryptItem('MyTable', 'user123', key);
  return restored;
};

2. If you must use RSA, avoid PKCS1 v1.5 and use constant-time checks

When using RSA, choose RSA-OAEP and ensure decryption errors do not leak via timing or distinguishable responses. Do not perform any additional logic based on whether decryption ‘succeeds’ before validating integrity.

const crypto = require('crypto');

// Generate or load RSA key pair (PEM strings)
const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
  modulusLength: 4096,
  publicKeyEncoding: { type: 'spki', format: 'pem' },
  privateKeyEncoding: { type: 'pkcs8', format: 'pem' }
});

function encryptRSAOAEP(plaintext, pubKey) {
  return crypto.publicEncrypt({
    key: pubKey,
    padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
    oaepHash: 'sha256'
  }, Buffer.from(plaintext));
}

function decryptRSAOAEP(ciphertext, privKey) {
  try {
    const decrypted = crypto.privateDecrypt({
      key: privKey,
      padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
      oaepHash: 'sha256'
    }, ciphertext);
    return decrypted.toString('utf8');
  } catch (err) {
    // Return a generic error; do not distinguish between padding and other failures
    throw new Error('decryption_failed');
  }
}

// Store encrypted blob in DynamoDB similarly to the AES example, using RSA-OAEP output.
// In handlers, call decryptRSAOAEP and treat all failures identically.

3. Ensure DynamoDB access patterns do not act as an oracle

Design your data model and API so that the existence or absence of an item in DynamoDB does not reveal whether decryption or validation succeeded. Use a consistent flow: retrieve a placeholder item when the record is missing, and always perform the cryptographic operation (with constant-time checks) before returning any response details.

// Example: always retrieve an item; if missing, use a dummy structure to keep timing consistent
async function getWithConsistentTiming(tableName, id, encryptionKey) {
  const params = {
    TableName: tableName,
    Key: marshall({ id: { S: id } })
  };
  const { Item } = await client.send(new GetItemCommand(params));
  const item = Item ? unmarshall(Item) : { iv: crypto.randomBytes(12), ciphertext: crypto.randomBytes(64), authTag: crypto.randomBytes(16) };

  try {
    const decipher = crypto.createDecipheriv('aes-256-gcm', encryptionKey, item.iv);
    decipher.setAuthTag(item.authTag);
    let plaintext = decipher.update(item.ciphertext);
    plaintext = Buffer.concat([plaintext, decipher.final()]);
    return plaintext.toString('utf8');
  } catch (err) {
    throw new Error('decryption_failed');
  }
}

By combining authenticated encryption, constant-time error handling, and consistent DynamoDB access patterns, you remove the conditions that enable a Bleichenbacher attack. middleBrick’s scans can help verify that your endpoints do not expose distinguishing behavior, but remember that middleBrick detects and reports — it does not fix or block.