I have enciphered a vector of bytes that has 17 bytes in itself. However, When I try to enciphered with AES, AES output has a 32-byte size? What is happening here?

  • 3
    It's a block cipher and it pads to a full 16 byte block.
    – user163495
    Jan 18, 2021 at 16:32

1 Answer 1


AES as it stands a block cipher with 16-byte block size and 16, 24, and 32-byte key sizes.

To encrypt even one bit, you need additional data. On the simple thaught, one can consider filling the rest with 0, then during decryption, there will be ambiguity. That is after the decryption, that data is 1 or 10 or 100 ... if the encrypted bit was 1 and similarly for the case of bit 0. Therefore we don't want ambiguity. There are solutions for this and this is called padding.

  1. Append 1 followed by 0's to fill the block. This is a bit padding and there is a byte version that is a pad with 8 then fill with 0. If the block was full, you need an additional block for padding to remove the ambiguity, again, since what if the last block ends with 1 ( or 8 in the byte case).

  2. PKCS#7 padding; this is a byte padding and common with CBC mode, let x be the remaining byte, then fill the rest with x as byte encoded. For example, if two bytes needed to fill then pad two times 0x02. This also has a special case, that what if the last block is full, the create a new block and fill with 0x1F 16-times

Now, you have said, you had 17 bytes then with AES this requires 2 blocks and that makes 32 bytes. It is highly probable that the library that you are using seamlessly handling the padding for you during the encryption and decryption.

Keep in mind that depending on the library this can be more; for example, the 16-byte IV/nonce of the CBC or CTR can be automatically prepended to the ciphertext and in your case, this will be 48 bytes for ECB, CBC.

If you used the CTR mode then you will have 33 bytes with prepended IV since CTR doesn't need padding.

And if you are using authenticated encryption like AES-GCM (internally uses the CTR) then the authentication tag can be automatically appended to ciphertext. The GCM's default tag size is 16-byte, this will make 49-byte if you are used such a library.

I hope you don't mix with Rijndael != AES. Rijndael can have 128, 160, 192, 218, and 256 block and key sizes, NIST selected just 3 from the Rijndael family, with fixed 128-bit block size and 128, 192, and 256-bit key sizes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .