padding oracle on downgraded legacy encryption