Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In block cipher modes of operation for encryption on input of a plaintext of $N$ blocks (We assume that the input size is always a multiple of the blockcipher mode: $N·16$ bytes) the size of the ciphertext is $N+1$, where the extra block is the IV.

Is there an efficient way to have fixed (parametrizable) larger length output on variable length input, to hide the plaintext size?

For example, for a short plaintext of $16$ or $20$ bytes I want to generate a larger ciphertext like 128 bytes, so an attacker can't learn the plaintext size from the ciphertext size.

The only way I can think of is just to produce pseudo-random pad to increase the plaintext message to equal the size of the ciphertext you want to output.

share|improve this question
It is not clear what "variable length output on variable length input" is intended to mean. – fgrieu Mar 11 '13 at 10:19
@fgrieu I.e: 16bytes of plaintext to 128*16bytes of ciphertext or to k*16bytes of ciphertext tuned by a parameter $k$ appropriately, given as input to the block cipher – curious Mar 11 '13 at 10:44
Definition by example is generally ambiguous. That example is parameterizable length output from fixed length input.Assuming you mean that an input of $b\ge1$ blocks cause an output length of $k\cdot b$ blocks for some parameter $k\ge2$: in the absence of other requirement, the solution outlined in the question (IV, ciphertext, and $(k-1)\cdot b-1$ blocks of randomness) seems as good as any of the many others. That's not generally studied, because cryptography rather tries to minimize the expansion of ciphertext. – fgrieu Mar 11 '13 at 11:24
I don't get your question, but you can use AES-CTR as PRNG. Stream ciphers and the expansion part of a PRNG are essentially the same thing. But that way the only input will be the key. – CodesInChaos Mar 11 '13 at 20:58
@curious I edited your question to actually ask that – please review my change and feel free to edit again if I didn't totally hit the question. – Paŭlo Ebermann Mar 13 '13 at 22:18

Counter mode (CTR mode) seems like it will do what you want. The length of the output is equal to the length of the input, plus the length of the IV. If this is not what you want, you'll need to explain your question/requirements more clearly.

In practice, I recommend you use an authenticated-encryption mode, such as EAX or GCM etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.