Does AES specify error messages when using the wrong password to decrypt?

Question

I am writing a small program which uses AES. In testing it with wrong passwords, I get error prompts from Microsoft C# component saying "the padding is bad"; whereas I expect wrongly decoded texts. Do these errors come from the original AES spec or not?

Answer 1

AES in general does not specify that it should return a bad padding message. In fact, AES in general says nothing about padding. Padding schemes are external to AES. Therefore, the message you are getting is .Net specific.

That said, be careful with these messages, as they can lead to a padding oracle attack.

Answer 2

Deeper explanation.

Decryption with a symmetric block cipher will always result in decrypted cipher text. However, symmtric block ciphers by themselves will only encrypt/decrypt blocks of data. To extend plain text to form N number of blocks, a padding algorithm is used.

This padding algorithm may simply add X number of bytes to form a full block, but this has the disadvantage that the length of the plain text must be communicated out of band, or within the plain text, as the padding cannot be distinquished from the plain text by the decryption algorithm. More often a padding as PKCS#5/PKCS#7 is used which always pads, even if the plain text is already the blocksize. The unpadding mechanism can then remove bytes starting from the end of the plain text.

If the ciphertext is mangled, if the key is wrong or if there was an implementation mistake, then the decryption of the last block will likely result in a block that has incorrect padding bytes, resulting in the exception you are getting. It's likely because you may have the bad luck that the padding is correct (the chance of this happening is slightly higher than 1/256 to be precise). Padding oracle attacks use this information to retrieve the plain text without doing any attacks on the blockcipher itself - and they are entirely practical.

You should perform integrity checks and add authentication (HMAC, MAC or an authenticating cipher mode) to prevent those kind of attacks, as well as to get more useful errors or exceptions.