Does storing the actual length of the message in metadata make an encrypted message more vulnerable to attack?

  • What kind of data is it (if you can say)? Why do you need to know the length?
    – Gray
    Commented Feb 24, 2014 at 16:46

1 Answer 1


Yes, storing the length of the original message in plain text will make your message slightly more vulnerable to a brute force attack, but it's not significant.

Assuming a suitable key length and suitable algorithm, there will likely be so many keys that would provide the same decrypted message length that knowing the length alone will not provide a suitable means to automate an attack. The attacker will need to know more information.

I wouldn't worry about it as long as you have a cryptographically strong key (length and randomness) and algorithm.

  • 1
    Just a though, but doesn't it kinda depends on the data? A silly example, but what if the encrypted value was an answer to the secret question: "What is your favorite US State?" If they know the length is '14' then it seriously reduces your possibilities. If it was an email address, and you knew 4 of the victim's email address, you might be able to figure it out. If it was a char count on a diary entry, then it would be pretty much useless.
    – Gray
    Commented Feb 24, 2014 at 16:43
  • @Gray, my answer assumes a random key. Commented Feb 24, 2014 at 17:06
  • I think your answer is a good one. I was just saying that there may be a time that the length of the plaintext could be used to guess the plaintext without decrypting it at all. My point was that sometimes, the length of the plaintext could be just as good as the text itself under very specific circumstances.
    – Gray
    Commented Feb 24, 2014 at 17:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .