Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to hide message length from adversary in symmetric key cryptography?

Suppose we want to hide message length from active and efficient adversaries.

share|improve this question
up vote 3 down vote accepted

Yes, you can pad the message with zero's or random values. As long as you can retrieve the location of the message inside the padded plaintext then you can hide the exact message length.

Note that statistical methods can still be applied; you will have to always create a message size of $N$ if you want to full hide the length of messages of $0$ to $N$ in length - excluding normal padding that may be required for block modes of encryption. Obviously, you still leak the information that the message is lower than $N$. But that cannot be avoided; an encrypted message of size $N$ cannot be created for all messages larger than $N$.

Just adding a (random) padding of random length may not be good enough as you will still leak some data about the message size if you average things out. This paper by Cihangir Tezcan and Serge Vaudenay makes it clear that providing random padding cannot practically hide enough information when a minimum amount of security is required. It still depends on the use case if random (sized) padding is sufficient for a use case, but it should be avoided.

share|improve this answer
Bit padding makes it very easy to "retrieve the location of the message inside the padded plaintext". $\hspace{.44 in}$ – Ricky Demer May 18 '14 at 18:25
@RickyDemer Yes, or including the length of the plaintext within the message and adding zero's, for instance using ASN.1. I like bitpadding. It does not have a maximum padding length and it does not require byte boundaries either. Finally, it is an extremely simple mechanism. It also poses on question less than PKCS#7 padding: "Should I check the values between the plaintext and the final byte value?" – Maarten Bodewes May 18 '14 at 20:40
@RickyDemer I made substantial edits on that article in Wiki actually, check for "Owlstead" in the history :) – Maarten Bodewes May 18 '14 at 20:43
I read abstract of this paper and it explains more about this – abdolahS May 19 '14 at 15:00
That paper nicely backs up that last paragraph with a slightly more scientific explanation :) – Maarten Bodewes May 19 '14 at 17:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.