Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
  1. Is the initial AES key (expanded to the key schedule) byte padded if less than e.g. 16 bytes?
  2. Is there a safe way of determining if decryption was successful (i.e. used the correct key)?
share|improve this question
1  
I.e. means "id est" in Latin, which in turns means that a more precise description of the statement will follow. As using an incorrect key is only one reason why decryption may fail, the question is not correctly stated here. It would work if you meant e.g., "exempli gratia", or "for example". –  Maarten Bodewes - owlstead Nov 16 '12 at 3:03

2 Answers 2

  1. AES by definition takes 16, 24 or 32 bytes as key, and nothing else. If you have a different size input use some kind of KDF to transform it to the correct length.

    If that input is a password this step is even more important. You should a key strengthening construction, such as PBKDF2 with sufficient iterations and a salt.

  2. If you use authenticated encryption, the verification of the authentication tag will fail if the key is incorrect. It's strongly recommended to use authenticated encryption. Not only will it tell you that the key is correct, it'll also prevent a variety of active attacks, such as padding oracles.

    You can either use an authenticated mode, such as AES-GCM, or normal AES followed by HMAC (Encrypt then MAC).

share|improve this answer
    
The statement is that decryption will fail if the key is faulty, and this is correct. But authenticated encryption does not provide a method to test if the key is incorrect. A decryption failure will also occur if the ciphertext has been altered. –  Maarten Bodewes - owlstead Nov 16 '12 at 3:04
1  
One caveat here with HMAC, if you use a separate MAC key, the MAC could check out just fine and the decryption be incorrect. This would happen if say the MAC key is correct, but the decryption key is incorrect. –  mikeazo Nov 16 '12 at 12:20
    
@mikeazo I avoid constructions with a non uniform key in most situations. I prefer some kind of hashing or KDF step in between. –  CodesInChaos Nov 16 '12 at 12:25
    
@CodesInChaos, right, that would be the proper way to do it (stackoverflow.com/questions/2501207/…) –  mikeazo Nov 16 '12 at 12:50
  1. If the key is too small, something like PBKDF2 should be used to expand the key to the proper size.

  2. An authenticated encryption mode such as GCM can be used. It outputs an authentication tag which is sent to the receiver. If the decryption is incorrect, decryption will instead reault in an error or a special symbol to signify this.

P.S., normally I would add links, but I am on a mobile device. I'll update when I get the chance.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.