 The attacker sets the last byte of formula_4 to formula_19 by setting the last byte of formula_3 to formula_21.The attacker then uses the same approach described above, this time modifying the second-to-last byte until the padding is correct (0x02, 0x02).If a block consists of 128 bits (AES, for example), which is 16 bytes, the attacker will obtain plaintext formula_4 in no more than 255⋅16 = 4080 attempts.