Assuming that a 32-byte plaintext is encrypted by AES 128 CBC - is it mandatory to add 16-byte padding, according to the different padding schemes?

3 Answers 3


Padding is a way to encrypt messages of a size that the block cipher would not be able to decrypt otherwise; it is a convention between whoever encrypts and whoever decrypts. If your input messages always have a length which can be processed with your encryption mode (e.g. your messages always have a length multiple of 16) then you do not have to add padding -- as long as during decryption, you do not try to look for a padding when there is none. If some of your messages require padding, then you will have to add some sort of padding systematically, otherwise decryption will be ambiguous.

Padding does not add security. Badly implemented padding management can leak information (padding oracles) so you have to be careful with your implementation -- preferably by not doing it yourself.

(Of course, you would be better served with an encryption mode which does not need any padding and includes the much needed but much overlooked integrity check; that would mean GCM or EAX, not CBC.)

  • 1
    Is it not more correct to say "padding in symmetric encryption does not add security"? Jan 31, 2013 at 21:47
  • 1
    Well, we are talking about symmetric encryption (AES-CBC) in this whole question. The "padding" which occurs in asymmetric encryption algorithms like RSA is a completely distinct animal, which is an integral part of the algorithm and is very important for security. Jan 31, 2013 at 21:57

It all depends on what you are encrypting. If you are encrypting data which always has a length of 32 bytes (or multiple of the block size) you do not have to use padding at all.

If the plain text is of arbitrary length, then you have to pad your text and use a mechanism to be able to separate the data from the padding when you decrypt.

Let's assume you are using a padding scheme in which you pad with 01 if one byte is missing, with 02 02 if 2 bytes are missing and so on.

You also have to add padding for 16 byte text because otherwise if you decrypt a text like

01 02 03 05 06 01 02 03 05 06 06 01

you would not be able to know if this was a 15 byte text:

01 02 03 05 06 01 02 03 05 06 06 + 01

padding a 16 byte text that was not padded:

01 02 03 05 06 01 02 03 05 06 06 01


The above problem is solved by knowing that you always pad your data, no matter the length.

  • Are the padding rules defined in the AES specification? If the length is 32, is it optional to add padding?
    – moti
    Jan 31, 2013 at 10:38
  • No, the AES specification does not define the padding rules.
    – Dinu
    Jan 31, 2013 at 10:45

It's not "mandatory" to add padding to a message that is a multiple of the block size, but most implementations do. PKCS#5 padding prescribes adding one block of bytes, all set to zero, to tell the algorithm that it does in fact have all of the blocks that were transmitted. This is helpful when the implementation could be called on to encrypt anything, of any length, and send it over an "unreliable" method of transport. When using a comms layer that has its own error checking, such as TCP, and when you know that the unpadded message is always an exact multiple of the block size used, it's redundant.

  • The comment about what to do in the case of a full block with PKCS#5 is not intuitive and not widely commented on. Mar 20, 2018 at 19:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .