Padding has two primary uses in cryptography, ensuring messages are the proper length necessary for certain ciphers (e.g., block ciphers) or to provide assurances not built into the core cipher (e.g., semantic security)
2
votes
1answer
68 views
How does OAEP improve the security of RSA?
The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$.
Does everybody (so also an adversary) know these functions?
If YES: How does it help the ...
1
vote
0answers
63 views
Is OAEP reversible?
Given nothing more than some integer $m =$ OAEP($M$), is it possible to recover the original plaintext $M$? In other words, without being given the hash functions or the random string used for ...
2
votes
2answers
127 views
Chain several RSA encryptions without increasing the message size
I would like to be able to encrypt the output of RSA with RSA again without having the output grow in size over time.
In other words, I have some data $D_0$ which I want to encrypt with RSA: $D_1 = ...
0
votes
1answer
96 views
Is there an efficient way to hide the encrypted plaintext length with a block cipher?
In block cipher modes of operation for encryption on input of a plaintext of $N$ blocks (We assume that the input size is always a multiple of the blockcipher mode: $N·16$ bytes) the size of the ...
1
vote
1answer
89 views
Padding always the same, problem or not?
I need to transmit long encrypted messages to a smartcard over a limited capacity link so I need to fragment the messages somewhere before sending thzm.
My problem is that I split the message into ...
2
votes
2answers
146 views
Is storing original file size in an encrypted file header a bad idea?
I'm encrypting a file using AES-256 in CBC mode. I'm padding to the 16-byte input multiple by using the PKCS#7 limit. The problem I'm currently having is that if I'm transferring or reading the ...
2
votes
0answers
55 views
Implementing PKCS#7 Padding on a Stream of Unknown Length?
I have a fairly simple Python program using PyCrypto to use AES+CBC to encrypt a stream of input. In order to adhere to the 16-byte input size multiple, I've implemented PKCS#7 by hand. (While I know ...
1
vote
2answers
100 views
Is semantic security important in a hybrid cryptosystem?
RSA doesn't provide semantic security when used unmodified, and neither does the commonly used PKCS#1 v.1.5 padding scheme for encryption.
Is this a problem for hybrid cryptosystems at all?
My ...
0
votes
0answers
38 views
Padding in PMAC
How does padding in PMAC work? I have been told two stories: Firstly, I have been told that it works similar to CMAC padding, and secondly, I have been told that it does not need padding.
I find the ...
3
votes
2answers
181 views
RSA blind signatures in practice
Hi I have a problem with moving my blind signature implementation from educational (textbook RSA) to more practical (padded RSA) side.
David Chaums paper gives a following figure:
$r$ - blinding ...
1
vote
2answers
212 views
AES key padding
Is the initial AES key (expanded to the key schedule) byte padded if less than e.g. 16 bytes?
Is there a safe way of determining if decryption was successful (i.e. used the correct key)?
5
votes
1answer
357 views
RSA-OAEP Input Parameters
When creating padding for RSA using OAEP, a message is prepared as follows:
Hash(Input Parameter) || Zeros || 1 || Message
My question is, what should the Input ...
0
votes
2answers
100 views
Is this how padding can work?
So for block ciphers you need a fixed size block.
If the plaintext length is not a multiple of the block length then you need to pad it.
One way you could do this is that for the last block you just ...
4
votes
1answer
123 views
Why does OAEP have 2 rounds with 2 random oracles?
I strive into understanding why OAEP has two rounds of computations and not just one. I.e: Wouldn't it be safe to hash the random number r and XOR it with the original message?What security risks if ...
0
votes
0answers
50 views
why these specific values used to initialize ipad & opad in HMAC [duplicate]
Possible Duplicate:
What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do?
I'm reading the book Network Security Essentials written by William Stallings.
in this book,in ...
0
votes
0answers
70 views
Why do we always append padding bits in SHA-512? [duplicate]
Possible Duplicate:
In the SHA hash algorithm, why is the message always padded?
I'm reading the book Network Security Essentials written by William Stallings.
To create a message digest ...
1
vote
1answer
124 views
How is block cipher padding verified for consistancy?
Under what circumstances is a decryption routine able to tell that the padding of a message is invalid? If a cipher text block where to be randomly modified, what is the probability that the padding ...
2
votes
4answers
849 views
Why is padding used for RSA encryption given that it is not a block cipher?
In AES we use some padded bytes at end of message to fit 128/256
byte blocks. But as RSA is not a block cipher why is padding used?
Can the message size be any byte length (is the encrypting agent
...
1
vote
1answer
116 views
Why does .NET's ECB mode implementation append a constant block to my ciphertext?
Consider the following code and output:
...
4
votes
1answer
477 views
How to securely use Elgamal encryption in libgcrypt?
How secure is libgcrypt's Elgamal implementation of encryption (how different it is from textbook Elgamal), and how can I tweak padding and other preprocessing actions?
For example, I know that usign ...
6
votes
2answers
268 views
What is the key strength reduction encrypting only 160 bits of data using RSA1024 for signatures
I am attempting to determine the strength of an incorrectly implemented 1024 bit RSA signature scheme. The weakness in the implementation is that the padding data lacks random numbers. As a result, ...
4
votes
1answer
486 views
Padding methods for block ciphers - PKCS7 vs ANSI X.923
I was looking through block cipher padding methods, and found two good candidates:
ANSI X.923 - pad with zeros, then a final byte for the padding length, e.g. ...
2
votes
3answers
424 views
Hash function in PBKDF2
From this excellent answer I learned (correct me if I am wrong) that when writing a block cipher with say key size 128 bit, one has to pad the password given (variable size) so that it becomes exactly ...
0
votes
1answer
385 views
Removing Padded Value in Decrypted Message
How to remove padded value in Decrypted Message?
I am using AES Algorithm..
ex:
this is the decrypted message..
"abcdefghijklmn "
there is a 2 space in that decrypted message which is equivalent ...
5
votes
3answers
918 views
In the SHA hash algorithm, why is the message always padded?
In the SHA hash algorithm the message is always padded, even if initially the correct length without padding; the padding is of the form "1" followed by the necessary number of 0s.
Why is it ...
5
votes
3answers
427 views
Is RSA padding needed for single recipient, one-time, unique random message?
I want a way to encrypt files using this process: http://crypto.stackexchange.com/a/15 . That is: generate a random password, use that to AES-encrypt a file, and use an RSA public key to encrypt the ...
5
votes
1answer
394 views
Why was ISO10126 Padding Withdrawn?
Wikipedia mentions ISO10126 Padding has been withdrawn, but doesn't say why. Also there were no news reports about this, as far as I can see.
Why was it withdrawn? Are there security flaws? Is there ...
4
votes
2answers
295 views
Does RSA padding have to be unpredictable if the payload is?
I'm trying to understand the precise requirements on padding when using RSA for encryption.
Suppose Alice uses RSA to encrypt a payload $M$ that cannot be guessed (say, a random nonce): Alice send ...
2
votes
1answer
408 views
Is RSA of a random nonce with no padding safe?
Consider the following protocol: Bob has a private RSA key $B_{priv}$, and Alice knows the public key $B_{pub}$. Alice wants to send confidential messages to Bob (no integrity intended). To send a ...
10
votes
1answer
2k views
How to choose a padding mode with AES
Depending on the framework you are using, there are various padding modes that can be used with AES encryption. For example, with .NET we can choose PKCS7, ISO10126, ANSIX923, Zeros or None.
I ...
9
votes
3answers
544 views
Why does the padding in MD5 contain the message length?
I understand the need for padding in MD5. But why do we append the message length to the padding?
I heard it strengthens the hash but how?
Please provide an example if possible and how it applies to ...
