Vulnerable code sample

import os
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives import hashes
from cryptography.exceptions import InvalidSignature

# This custom exception is used to signal a decryption failure.
# In a real-world scenario, an attacker would measure the time it takes
# to receive this error.
class DecryptionError(Exception):
    pass

def vulnerable_rsa_pkcs1v15_decrypt(private_key, ciphertext):
    """
    A function that simulates the vulnerable decryption process in old Authlib versions.
    It catches the specific padding error from the underlying cryptography library
    and re-raises it, breaking the constant-time properties and creating a padding oracle.
    An attacker can distinguish between a padding error and other errors.
    """
    try:
        plaintext = private_key.decrypt(
            ciphertext,
            padding.PKCS1v15()
        )
        return plaintext
    except ValueError:
        # This is the core of the vulnerability.
        # The underlying library `cryptography` raises a generic ValueError for padding errors
        # to prevent timing attacks. By catching this specific error and handling it
        # differently, we leak information that the padding was incorrect.
        # An attacker can use this information to iteratively decrypt the ciphertext.
        raise DecryptionError("Invalid PKCS#1 v1.5 padding")
    except Exception as e:
        # Other potential errors are handled generically.
        raise DecryptionError(f"An unknown decryption error occurred: {e}")

if __name__ == '__main__':
    # 1. Setup: Generate an RSA key pair.
    private_key = rsa.generate_private_key(
        public_exponent=65537,
        key_size=2048,
    )
    public_key = private_key.public_key()

    # 2. Create a message and encrypt it correctly.
    secret_message = b"this is a highly confidential message"
    
    # In a real JWE, this would be a Content Encryption Key (CEK)
    valid_ciphertext = public_key.encrypt(
        secret_message,
        padding.PKCS1v15()
    )

    print(f"Original Message: {secret_message}")
    print("-" * 30)

    # 3. Demonstrate successful decryption with a valid ciphertext.
    try:
        decrypted_message = vulnerable_rsa_pkcs1v15_decrypt(private_key, valid_ciphertext)
        print(f"SUCCESS: Decrypted valid ciphertext: {decrypted_message}")
    except DecryptionError as e:
        print(f"ERROR: Decryption of valid ciphertext failed: {e}")

    print("-" * 30)

    # 4. Demonstrate the vulnerability with a manipulated ciphertext.
    # We simulate an attacker's probe by slightly changing the ciphertext.
    # This will almost certainly cause a padding error.
    malformed_ciphertext = bytearray(valid_ciphertext)
    malformed_ciphertext[20] ^= 0xFF  # Flip some bits in the ciphertext

    print("ATTACKER PROBE: Attempting to decrypt a malformed ciphertext...")

    try:
        vulnerable_rsa_pkcs1v15_decrypt(private_key, bytes(malformed_ciphertext))
    except DecryptionError as e:
        # The specific error message "Invalid PKCS#1 v1.5 padding" is the "oracle".
        # It confirms to the attacker that their guess resulted in a padding error,
        # rather than some other cryptographic failure.
        # This is the information leak.
        print(f"ORACLE LEAK: Server responded with a specific padding error: '{e}'")
        print("\nThis confirms the vulnerability. The server should not distinguish between padding errors and other decryption errors.")