# Does AES specify error messages when using the wrong password to decrypt?

I am writing a small program which uses AES. In testing it with wrong passwords, I get error prompts from Microsoft C# component saying "the padding is bad"; whereas I expect wrongly decoded texts. Do these errors come from the original AES spec or not?

-
Plain AES doesn't work with passwords. Key derivation is a separate concern, and should be done with a good key derivation function, such as PBKDF2. –  CodesInChaos Mar 30 '12 at 19:44

AES in general does not specify that it should return a bad padding message. In fact, AES in general says nothing about padding. Padding schemes are external to AES. Therefore, the message you are getting is .Net specific.

That said, be careful with these messages, as they can lead to a padding oracle attack.

-

Decryption of a complete block of data with a symmetric block cipher - such as AES - will always succeed. The result of decrypting with a block cipher mode of operation that requires padding of the plaintext however may fail.

Block ciphers can only encrypt a block at a time. They have to be used as primitive within a block cipher mode of operation to be able to encrypt a variable amount of plaintext. Block cipher modes of operation such as CTR can already encrypt plaintext of any size (up to a maximum). However, modes of operation such as ECB (insecure) or CBC are only able to encrypt a plaintext that consist of N-times the block size. To make a plain text of an arbitrary size form an N-number of blocks, a padding algorithm must be used.

This padding could be any one of a set of known padding algorithms. Usually however PKCS#7 padding (sometimes also called PKCS#5 padding) is used. This is a deterministic scheme in the sense that the unpadding is completely independent of the contents of the plaintext.

Decryption in ECB or CBC mode expects a ciphertext that is N-times the block size. If it is not N-times the block size then an error is raised. If the ciphertext is N-times the block size, then the decryption always succeeds. The result is expected to be the plaintext and the padding. The unpadding algorithm in turn tries to remove the padding.

If the ciphertext was mangled or if the incorrect key was used then then the decryption of the last block will likely result in a block that has invalid padding. In CBC mode an incorrect IV may also result in incorrect padding for short plaintext/ciphertext pairs. If incorrect padding is detected then the unpadding code will opt out and raise an error, such as the exception you are getting. This will happen for any padding mode that has to verify padding values.

As the unpadding algorithm is fed random data, there is a small but significant chance that the unpadding does not detect an error. The chance of this happening is slightly higher than 1/256 for PKCS#7 padding, because there is about a 1/256 chance that the result ends with 01. In that case no error is raised and an incorrect plaintext is returned.

Even worse, CBC mode padding oracle attacks try to detect the error or exception. They use this information to retrieve the plain text without performing any attacks on the block cipher itself - and they are entirely practical.

You should perform integrity checks and add authentication (HMAC, MAC or an authenticated mode of operation) to prevent padding oracle attacks. This will make sure that you will always get an error or exception if the incorrect ciphertext or key is used; that way you will always receive the correct plaintext after unpadding.

-