Tagged Questions

Padding has two primary uses in cryptography, ensuring messages are the proper length necessary for certain ciphers (e.g., block ciphers) or to provide assurances not built into the core cipher (e.g., semantic security)

learn more… | top users | synonyms

1
vote
1answer
50 views

How to encrypt letters less than block n using Hill Cipher

I am learning about Hill Cipher and know that it is a block cipher where each block of n letters (considered as an $n$-component vector) is multiplied by an invertible $n \times n$ matrix, again ...
1
vote
2answers
86 views

Random vs. Fixed Paddings

Is there any consensus (i.e. are there any research results) on the benefits and drawbacks of various padding schemes? Generally there seem to be two kinds of them: random paddings, like ISO10126 ...
0
votes
0answers
38 views

Partial Homomorphic Schemes with padding

As mentioned in wikipedia there are many Partial Homomorphic Encryption(PHE) scheme like RSA, Elgamal, Pailler etc. But out of them only unpadded RSA scheme seems to be partial(multiplicative) ...
3
votes
2answers
67 views

Why verify padding at all?

Whenever a ciphertext is decrypted using a block-cypher, we need to remove the padding. There are different ways to add padding, but they usually set the last byte of the last block to the number of ...
2
votes
1answer
52 views

Bit padding instead of PKCS#5 padding

Padding oracle attacks are a huge nuisance when using CBC mode encryption without authentication. Wouldn't all those padding oracle attacks be avoided if we'd just use bit padding instead? Or is does ...
-3
votes
1answer
127 views

Currently i am doing decryption for RSA encoding and i face some problem with it [closed]

I am very new to cryptography so I don’t know much about it. I have been given a very large $N$ value and $E$ value to decrypt a ciphertext which was created using a AES 128 key and a IV by using RSA ...
2
votes
1answer
60 views

Is HMAC padding the same as bcrypt?

I have been watching Christof Paar on his YouTube lectures also I used bcrypt to store two passwords with salts and I find that I have a few questions. I am interested in what bcrypt does to the ...
2
votes
0answers
123 views

RSA encryption and signature padding flaw

This is Oxford's computer security exam question: Suppose that Bob has published an RSA encryption key $ke$ (retaining in secret the corresponding decryption key $kd$), and Alice has published a ...
1
vote
0answers
47 views

Does not using padding mean a lack of security?

I've read several texts which say that if the entire plaintext is a multiple of the block-size padding is not required (and not using padding would not mean a loss of security). I generally disagree ...
2
votes
1answer
189 views

Why does HMAC need a fixed length padding?

As everybody knows in order to calculate HMAC we have to concatenate padding to the message. I am just curious why the padding needs to be fixed-length. Why do we need the blocksize parameter here? ...
4
votes
1answer
288 views

Is PKCS #1 v1.5 RSA encryption padding secure under these conditions?

The PKCS #1 v1.5 padding scheme for RSA has been proven to have some weakness when used with TLS for example. My question is: is it still secure under the following conditions? Alice sends a ...
2
votes
2answers
189 views

How does compression before encryption leak info about the input?

Apparently current best practices recommend that you do not compress before you encrypt. For example in this blog entry (*): http://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/ It ...
4
votes
1answer
343 views

What prevents a padding standard to cause a data loss?

In here different byte padding standards are listed as ANSI X.923, ISO 101.26, PKCS7, ISO/IEC 7816-4 and zero padding. All of them seems to apply padding to the last byte blocks. Odds are rare but ...
-3
votes
1answer
53 views

Selection of cryptographic functions for OAEP

I can't understand how the "cryptographic functions" are to be selected RSA + OAEP which are used in OAEP. How to choose these "cryptographic functions"(G and H)?
2
votes
1answer
160 views

Why should a signature use PSS padding in RSA?

Suppose I send a message using AES (private keys already negotiated securely) and I send a hash of this message using RSA (encrypted with private key) with OAEP to verify the authenticity and ...
3
votes
1answer
223 views

Questions about OAEP for RSA

I have two questions about OAEP for RSA. How are the number of bits to pad with 0 chosen? For example, if I'm sending a 255 byte message with RSA-2048 I have 8 unused bits (1 byte). Should I split ...
-1
votes
1answer
253 views

Is the random data at the end of my decrypted message supposed to be there?

This is my PKCS#5 & AES/ECB Python 3.3 code: ...
2
votes
1answer
82 views

Usability of padding scheme in blinded RSA signature?

In Wikipedia's article on Blind signature, in the section Dangers of blind signing which describes RSA blinding attack one reads the following This attack works because in this blind signature ...
4
votes
1answer
366 views

RSA Encryption and Signature - Weak Padding

Assume that I have an plaintext $m$ and it is padded with $randompad||00||m$ and then it is encrypted with RSA and a public encryption key so we get the encrypted $Sm$. Then to assure its integrity ...
6
votes
2answers
313 views

RSA Signature Weak Padding Attack

Assume that we have a message $m$ of size $n$, and it is padded with two 01 bytes in front. Then the signature $s$ is computed using a private key $ks$. Can we ...
3
votes
1answer
207 views

How is an AES Encrypted Message Decrypted with Random Padding?

One thing I was surprised to learn about AES is that random padding can be added to the message to make it a multiple of block size. What I can not wrap my head around is how this random padding can ...
3
votes
1answer
204 views

Purpose of leading zero in PKCS1-v1_5 padding

According to this document the padded message has the following structure: $EM \;= \; 0x00 \; || \; 0x02 \; || \; PS \; || \; 0x00 \; || \; M$ What is the purpose of this null byte at the beginning ...
3
votes
1answer
88 views

OMAC : Padding on empty string

I started to implement some MAC since last week with the specifications given here. I'm currently testing the OMAC (one-key CBC) with test vectors. In the OMAC specifications at page 4, they explain ...
2
votes
1answer
694 views

Is it true for Java that the transformation mode and padding is ignored when using RSA?

Consider GregS's comment to this question (more specific to bouncycastle's provider implementation): http://stackoverflow.com/questions/11717646/bouncycastle-rsa-key-size-and-padding The mode, ...
1
vote
1answer
489 views

How are IVs used in association with RSA Encryption?

How are IVs used in association with RSA Encryption? Can someone explain why we use them in this RSA context?
1
vote
1answer
2k views

Can AES use PKCS#5 padding

From What is the difference between PKCS#5 padding and PKCS#7 padding, I understand that PKCS#5 is defined for 8 byte block sizes. Does this rule it out as a padding option for AES since AES has a ...
0
votes
1answer
832 views

Implementing OpenSSL padding

I'm conducting an experiment dealing with differences in padding across different aes operations for my Intro to Crypto class, and the question says OpenSSL uses PKCS5 padding, and that I need to ...
2
votes
1answer
783 views

OpenSSL padding

I would like to know how much padding OpenSSL algorithms expect.
2
votes
1answer
252 views

Is it safe to use GZIP to avoid padding related attacks

I am designing a library that supports encrypting some in-memory data using AES in CBC mode. Now I need a padding but it seemed to me that Apple's CommonCrypto library and OpenSSL have different ...
1
vote
1answer
144 views

Security of (cryptographic) padding compared to other methods for blockcompletion for block ciphers

As said in the heading, I want to know how the security of different padding methods, e.g. ANSI X.923, ISO 10126 and PKCS7, is compared to other methods to reach the needed block size, like ciphertext ...
6
votes
2answers
588 views

Strength of CBC with Ciphertext Stealing

Is CBC with Ciphertext Stealing (CTS) considerably weaker than CBC with padding such as PKCS7? I would imagine the most common situation where CTS is necessary would be due to some size constraint of ...
4
votes
3answers
205 views

Can padding length, and thus plaintext length, be considered public information when using aes-cbc?

Right now I'm using a simple padding system that takes the plaintext, hashes it with SHA512, and appends $x$ bytes of the hash as padding where $x$ is the delta between the plaintext and nearest ...
1
vote
1answer
1k views

How is input message for SHA-2 padded?

I read about how is an input message prepared to be hashed by MD4,MD5 or SHA-1: Step1 Append padding bits The input message is "padded" (extended) so that its length (in bits) equals to 448 ...
1
vote
1answer
272 views

RSA padding: what is it and how does that work?

If I am not mistaken, plaintext RSA is not secure. So, I have read that padding and hashing is needed to make the RSA algorithm secure. However, I am confused on what does padding or armoring mean in ...
16
votes
1answer
10k views

What is the difference between PKCS#5 padding and PKCS#7 padding

One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The ...
4
votes
1answer
194 views

How to pad messages with large amount of padding

I'm playing around with an application for secure email-like communication and I want to perform length hiding padding on the plaintext messages so they always have a consistent size before encrypting ...
2
votes
1answer
426 views

How does OAEP improve the security of RSA?

The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$. Does everybody (so also an adversary) know these functions? If YES: How does it help the ...
1
vote
0answers
105 views

Is OAEP reversible?

Given nothing more than some integer $m =$ OAEP($M$), is it possible to recover the original plaintext $M$? In other words, without being given the hash functions or the random string used for ...
2
votes
2answers
258 views

Chain several RSA encryptions without increasing the message size

I would like to be able to encrypt the output of RSA with RSA again without having the output grow in size over time. In other words, I have some data $D_0$ which I want to encrypt with RSA: $D_1 = ...
1
vote
1answer
169 views

Is there an efficient way to hide the encrypted plaintext length with a block cipher?

In block cipher modes of operation for encryption on input of a plaintext of $N$ blocks (We assume that the input size is always a multiple of the blockcipher mode: $N·16$ bytes) the size of the ...
2
votes
1answer
116 views

Padding always the same, problem or not?

I need to transmit long encrypted messages to a smartcard over a limited capacity link so I need to fragment the messages somewhere before sending thzm. My problem is that I split the message into ...
1
vote
2answers
500 views

Is storing original file size in an encrypted file header a bad idea?

I'm encrypting a file using AES-256 in CBC mode. I'm padding to the 16-byte input multiple by using the PKCS#7 limit. The problem I'm currently having is that if I'm transferring or reading the ...
3
votes
2answers
514 views

Implementing PKCS#7 Padding on a Stream of Unknown Length?

I have a fairly simple Python program using PyCrypto to use AES+CBC to encrypt a stream of input. In order to adhere to the 16-byte input size multiple, I've implemented PKCS#7 by hand. (While I know ...
2
votes
2answers
245 views

Is semantic security important in a hybrid cryptosystem?

RSA doesn't provide semantic security when used unmodified, and neither does the commonly used PKCS#1 v.1.5 padding scheme for encryption. Is this a problem for hybrid cryptosystems at all? My ...
3
votes
1answer
68 views

Padding in PMAC

How does padding in PMAC work? I have been told two stories: Firstly, I have been told that it works similar to CMAC padding, and secondly, I have been told that it does not need padding. I find the ...
4
votes
2answers
1k views

RSA blind signatures in practice

Hi I have a problem with moving my blind signature implementation from educational (textbook RSA) to more practical (padded RSA) side. David Chaums paper gives a following figure: $r$ - blinding ...
0
votes
2answers
176 views

Is this how padding can work?

So for block ciphers you need a fixed size block. If the plaintext length is not a multiple of the block length then you need to pad it. One way you could do this is that for the last block you just ...
1
vote
2answers
565 views

AES key padding

Is the initial AES key (expanded to the key schedule) byte padded if less than e.g. 16 bytes? Is there a safe way of determining if decryption was successful (i.e. used the correct key)?
5
votes
2answers
213 views

Why does OAEP have 2 rounds with 2 random oracles?

I strive into understanding why OAEP has two rounds of computations and not just one. I.e: Wouldn't it be safe to hash the random number r and XOR it with the original message?What security risks if ...
1
vote
0answers
80 views

Why do we always append padding bits in SHA-512? [duplicate]

Possible Duplicate: In the SHA hash algorithm, why is the message always padded? I'm reading the book Network Security Essentials written by William Stallings. To create a message digest ...