Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I am writing a small program which uses AES. In testing it with wrong passwords, I get error prompts from Microsoft C# component saying "the padding is bad"; whereas I expect wrongly decoded texts. Do these errors come from the original AES spec or not?

share|improve this question
Plain AES doesn't work with passwords. Key derivation is a separate concern, and should be done with a good key derivation function, such as PBKDF2. –  CodesInChaos Mar 30 '12 at 19:44

2 Answers 2

up vote 9 down vote accepted

AES in general does not specify that it should return a bad padding message. In fact, AES in general says nothing about padding. Padding schemes are external to AES. Therefore, the message you are getting is .Net specific.

That said, be careful with these messages, as they can lead to a padding oracle attack.

share|improve this answer

Deeper explanation.

Decryption with a symmetric block cipher will always result in decrypted cipher text. However, symmtric block ciphers by themselves will only encrypt/decrypt blocks of data. To extend plain text to form N number of blocks, a padding algorithm is used.

This padding algorithm may simply add X number of bytes to form a full block, but this has the disadvantage that the length of the plain text must be communicated out of band, or within the plain text, as the padding cannot be distinquished from the plain text by the decryption algorithm. More often a padding as PKCS#5/PKCS#7 is used which always pads, even if the plain text is already the blocksize. The unpadding mechanism can then remove bytes starting from the end of the plain text.

If the ciphertext is mangled, if the key is wrong or if there was an implementation mistake, then the decryption of the last block will likely result in a block that has incorrect padding bytes, resulting in the exception you are getting. It's likely because you may have the bad luck that the padding is correct (the chance of this happening is slightly higher than 1/256 to be precise). Padding oracle attacks use this information to retrieve the plain text without doing any attacks on the blockcipher itself - and they are entirely practical.

You should perform integrity checks and add authentication (HMAC, MAC or an authenticating cipher mode) to prevent those kind of attacks, as well as to get more useful errors or exceptions.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.