Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As said in the heading, I want to know how the security of different padding methods, e.g. ANSI X.923, ISO 10126 and PKCS7, is compared to other methods to reach the needed block size, like ciphertext stealing or residual block termination. And what is about the counter mode of operation?

I heard that oracle attacks are possible if padding was applied, but have the other methods also disadvantages (except a higher complexity)? Or are there any possible ways for the problem that I forgot, that are more recommended?

share|improve this question
To prevent oracle attacks, you should add a MAC using an encrypt-then-mac scheme. Most unauthenticated encryption schemes suffer from some kind of active attack, a padding oracle is just the most famous. – CodesInChaos Sep 9 '13 at 8:39
Your solution seems interesting. Could you please provide some information who this helps preventing a padding oracle attack? – Simon Rühle Sep 9 '13 at 10:24
If you verify the MAC before you start decrypting, then any message the attacker has modified (a prerequisite of a padding-oracle attack) won't reach the cipher. So a secure MAC prevents all active attacks against the encryption scheme. – CodesInChaos Sep 9 '13 at 10:41
I hope I have understood it right now. So you mean, if I verify that the encrypted message has not been modified, a padding oracle can be avoided? What kind of MAC can be used here? A hash like SHA-512 or better CBC? – Simon Rühle Sep 10 '13 at 10:03
HMAC-SHA-2, not plain SHA-2. And it's essential that you compute the MAC over the whole ciphertext (including IV and padding) and not over the plaintext. So you verify the MAC before you decrypt, not after. Another issue is that you need a constant time comparison function for the MAC verification, else you're open to timing attacks. – CodesInChaos Sep 10 '13 at 10:45
up vote 2 down vote accepted

The security of these schemes is all comparable, as far as I am aware. In all cases, you need to use authentication (e.g., Encrypt-then-MAC). Padding attacks are just one way that security can fail if you omit the authentication, but all of these schemes will have serious security problems if you omit the authentication. So, don't forget the authentication.

Bottom line: I don't know of any compelling security reason to choose one of these methods over any other, assuming that you are using the crypto correctly. You can choose on other grounds, e.g., interoperability, performance, ease of implementation, etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.