Bleichenbacher Attack in Koa (Javascript)

To mitigate Bleichenbacher attacks in Koa applications, developers must eliminate padding oracles by ensuring uniform error handling and using modern cryptographic standards. The following JavaScript code demonstrates a secure Koa middleware for decrypting RSA payloads using OAEP padding (which is not vulnerable to Bleichenbacher) and constant-time error responses.

const Koa = require('koa');
const crypto = require('crypto');
const app = new Koa();

// Load private key (in practice, use secure key management)
const privateKey = crypto.createPrivateKey({
  key: fs.readFileSync('private_key.pem', 'utf8'),
  format: 'pem',
  type: 'pkcs8',
});

app.use(async (ctx, next) => {
  try {
    const { encryptedData } = ctx.request.body;
    if (!encryptedData) {
      ctx.status = 400;
      ctx.body = { error: 'Invalid request' };
      return;
    }

    // Always use OAEP padding — immune to Bleichenbacher
    const decrypted = crypto.privateDecrypt(
      {
        key: privateKey,
        padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
        oaepHash: 'sha256',
      },
      Buffer.from(encryptedData, 'base64')
    );

    ctx.state.decrypted = decrypted.toString('utf8');
    await next();
  } catch (err) {
    // Uniform error response: same status, same message, constant-time delay
    // Simulate fixed processing time to avoid timing leaks
    await new Promise(resolve => setTimeout(resolve, 100));
    ctx.status = 400;
    ctx.body = { error: 'Decryption failed' };
  }
});

app.use(ctx => {
  ctx.body = { message: 'Data processed securely', data: ctx.state.decrypted };
});

app.listen(3000);

Key fixes in this code:

• OAEP padding: Replaces PKCS#1 v1.5 with RSAES-OAEP, which provably resists adaptive chosen-ciphertext attacks.
• Uniform error handling: All decryption failures — whether due to invalid padding, incorrect key, or malformed input — return identical HTTP 400 responses with the same generic message.
• Constant-time delay: A fixed 100ms delay (simulated via setTimeout) prevents attackers from distinguishing error types based on response timing. In production, use constant-time crypto functions or blinding techniques.
• Input validation: Checks for missing encryptedData before processing.

For legacy systems requiring PKCS#1 v1.5 (not recommended), apply RSA blinding or use libraries like node-forge with explicit constant-time guarantees, but migrating to OAEP is the preferred and simpler defense. middleBrick’s scanner detects padding oracle behavior by analyzing response variations across crafted ciphertexts, helping teams identify such flaws before deployment.