Lucky Thirteen

cryptography

A 2013 timing attack against CBC padding in TLS.

Lucky Thirteen measured tiny timing differences in how TLS processed CBC padding to recover plaintext byte by byte. It reinforced the case for moving away from CBC mode toward AEAD ciphers.

Lucky Thirteen is a timing attack on TLS's older CBC construction. The protocol computed the MAC over the plaintext and then padded, so the amount of work a server did when rejecting a record depended on the padding, and that dependence was measurable as a tiny timing difference.

The difficulty of exploiting it is part of what makes it instructive. The signal is microseconds, requires many thousands of attempts, and is easiest with network proximity, so it sits at the edge of practicality. It was still worth fixing, because attacks only improve, and a measurable side channel is a vulnerability whose exploitation cost is a moving number.

The structural fix was ordering. MAC-then-encrypt puts the integrity check on data that has already been processed, which is what creates the timing dependence; encrypt-then-MAC and the AEAD modes that replaced both verify integrity before touching the plaintext at all. TLS 1.3 removed CBC entirely for this reason. The general lesson is that constant-time behaviour is a design property rather than an implementation detail you can add later.

Also known as: Lucky Thirteen, Lucky 13, CVE-2013-0169

← All glossary entries