 If the padding is correct, the attacker now knows that the last byte of formula_11 is formula_12.Therefore, formula_13.If the padding is incorrect, the attacker can change the last byte of formula_8 to the next possible value.