I was looking through block cipher padding methods, and found two good candidates:
- ANSI X.923 - pad with zeros, then a final byte for the padding length, e.g.
00 00 00 04
. - PKCS7 - pad with bytes that each show the number of padding bytes, e.g.
04 04 04 04
.
Is there any benefit to using PKCS7 over ANSI X.923 padding, or vice versa?
80 00
for me. The only thing I like better is no padding. Any padding mode can be used for padding oracle attacks, so please do provide an authentication tag and never rely on padding (for symmetric block ciphers) for security. $\endgroup$