Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Is there any way to hide message length from adversary in symmetric key cryptography?

Suppose we want to hide message length from active and efficient adversaries.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Yes, you can pad the message with zero's or random values. As long as you can retrieve the location of the message inside the padded plaintext then you can hide the exact message length.

Note that statistical methods can still be applied; you will have to always create a message size of $N$ if you want to full hide the length of messages of $0$ to $N$ in length - excluding normal padding that may be required for block modes of encryption. Obviously, you still leak the information that the message is lower than $N$. But that cannot be avoided; an encrypted message of size $N$ cannot be created for all messages larger than $N$.

Just adding a (random) padding of random length may not be good enough as you will still leak some data about the message size if you average things out. This paper by Cihangir Tezcan and Serge Vaudenay makes it clear that providing random padding cannot practically hide enough information when a minimum amount of security is required. It still depends on the use case if random (sized) padding is sufficient for a use case, but it should be avoided.

share|improve this answer
1  
Bit padding makes it very easy to "retrieve the location of the message inside the padded plaintext". $\hspace{.44 in}$ –  Ricky Demer May 18 at 18:25
    
@RickyDemer Yes, or including the length of the plaintext within the message and adding zero's, for instance using ASN.1. I like bitpadding. It does not have a maximum padding length and it does not require byte boundaries either. Finally, it is an extremely simple mechanism. It also poses on question less than PKCS#7 padding: "Should I check the values between the plaintext and the final byte value?" –  owlstead May 18 at 20:40
    
@RickyDemer I made substantial edits on that article in Wiki actually, check for "Owlstead" in the history :) –  owlstead May 18 at 20:43
2  
I read abstract of this paper and it explains more about this issue:cihangir.forgottenlance.com/papers/lengthhiding-corrected.pdf –  abdolahS May 19 at 15:00
    
That paper nicely backs up that last paragraph with a slightly more scientific explanation :) –  owlstead May 19 at 17:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.