AES key padding

Question

Is the initial AES key (expanded to the key schedule) byte padded if less than e.g. 16 bytes?
Is there a safe way of determining if decryption was successful (i.e. used the correct key)?

I.e. means "id est" in Latin, which in turns means that a more precise description of the statement will follow. As using an incorrect key is only one reason why decryption may fail, the question is not correctly stated here. It would work if you meant e.g., "exempli gratia", or "for example".

CodesInChaos · Answer 1 · 2012-11-15 21:27:46Z

AES by definition takes 16, 24 or 32 bytes as key, and nothing else. If you have a different size input use some kind of KDF to transform it to the correct length.

If that input is a password this step is even more important. You should a key strengthening construction, such as PBKDF2 with sufficient iterations and a salt.
If you use authenticated encryption, the verification of the authentication tag will fail if the key is incorrect. It's strongly recommended to use authenticated encryption. Not only will it tell you that the key is correct, it'll also prevent a variety of active attacks, such as padding oracles.

You can either use an authenticated mode, such as AES-GCM, or normal AES followed by HMAC (Encrypt then MAC).

The statement is that decryption will fail if the key is faulty, and this is correct. But authenticated encryption does not provide a method to test if the key is incorrect. A decryption failure will also occur if the ciphertext has been altered.
One caveat here with HMAC, if you use a separate MAC key, the MAC could check out just fine and the decryption be incorrect. This would happen if say the MAC key is correct, but the decryption key is incorrect.
@mikeazo I avoid constructions with a non uniform key in most situations. I prefer some kind of hashing or KDF step in between.
@CodesInChaos, right, that would be the proper way to do it (stackoverflow.com/questions/2501207/…)

mikeazo · Answer 2 · 2012-11-15 21:17:18Z

If the key is too small, something like PBKDF2 should be used to expand the key to the proper size.
An authenticated encryption mode such as GCM can be used. It outputs an authentication tag which is sent to the receiver. If the decryption is incorrect, decryption will instead reault in an error or a special symbol to signify this.

P.S., normally I would add links, but I am on a mobile device. I'll update when I get the chance.

2 Answers