Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Assuming that a 32-byte plaintext is encrypted by AES 128 CBC - is it mandatory to add 16-byte padding, according to the different padding schemes?

share|improve this question

3 Answers 3

up vote 7 down vote accepted

Padding is a way to encrypt messages of a size that the block cipher would not be able to decrypt otherwise; it is a convention between whoever encrypts and whoever decrypts. If your input messages always have a length which can be processed with your encryption mode (e.g. your messages always have a length multiple of 16) then you do not have to add padding -- as long as during decryption, you do not try to look for a padding when there is none. If some of your messages require padding, then you will have to add some sort of padding systematically, otherwise decryption will be ambiguous.

Padding does not add security. Badly implemented padding management can leak information (padding oracles) so you have to be careful with your implementation -- preferably by not doing it yourself.

(Of course, you would be better served with an encryption mode which does not need any padding and includes the much needed but much overlooked integrity check; that would mean GCM or EAX, not CBC.)

share|improve this answer
1  
Is it not more correct to say "padding in symmetric encryption does not add security"? –  mr.spuratic Jan 31 '13 at 21:47
    
Well, we are talking about symmetric encryption (AES-CBC) in this whole question. The "padding" which occurs in asymmetric encryption algorithms like RSA is a completely distinct animal, which is an integral part of the algorithm and is very important for security. –  Thomas Pornin Jan 31 '13 at 21:57

It all depends on what you are encrypting. If you are encrypting data which always has a length of 32 bytes (or multiple of the block size) you do not have to use padding at all.

If the plain text is of arbitrary length, then you have to pad your text and use a mechanism to be able to separate the data from the padding when you decrypt.

Let's assume you are using a padding scheme in which you pad with 01 if one byte is missing, with 02 02 if 2 bytes are missing and so on.

You also have to add padding for 16 byte text because otherwise if you decrypt a text like

01 02 03 05 06 01 02 03 05 06 06 01

you would not be able to know if this was a 15 byte text:

01 02 03 05 06 01 02 03 05 06 06 + 01

padding a 16 byte text that was not padded:

01 02 03 05 06 01 02 03 05 06 06 01

.

The above problem is solved by knowing that you always pad your data, no matter the length.

share|improve this answer
    
Are the padding rules defined in the AES specification? If the length is 32, is it optional to add padding? –  moti Jan 31 '13 at 10:38
    
No, the AES specification does not define the padding rules. –  Dinu S Jan 31 '13 at 10:45

It's not "mandatory" to add padding to a message that is a multiple of the block size, but most implementations do. PKCS#5 padding prescribes adding one block of bytes, all set to zero, to tell the algorithm that it does in fact have all of the blocks that were transmitted. This is helpful when the implementation could be called on to encrypt anything, of any length, and send it over an "unreliable" method of transport. When using a comms layer that has its own error checking, such as TCP, and when you know that the unpadded message is always an exact multiple of the block size used, it's redundant.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.