Under what circumstances is a decryption routine able to tell that the padding of a message is invalid? If a cipher text block where to be randomly modified, what is the probability that the padding would be correct? How does the type of padding influence the detectability of cipher text that has been tampered with?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Let's say we are using PKCS#7 padding, and we'll stick to a single block message for simplicity. Modifying the ciphertext should result in an completely random decryption. To get proper padding, the resulting decryption would have to look something like this
Since the result is random, the probability that you would get
Looking at this padding method, it is easy to see how one would detect a modified ciphertext by simply looking at the padding. If the resulting plaintext is something like
Other padding methods, for example, will have different probabilities. For example, ISO 10126 uses random padding with the last byte used to tell how much padding was used. If the block size is 16 bytes, a last byte of