Padding has two primary uses in cryptography, ensuring messages are the proper length necessary for certain ciphers (e.g., block ciphers) or to provide assurances not built into the core cipher (e.g., semantic security)
10
votes
1answer
2k views
How to choose a padding mode with AES
Depending on the framework you are using, there are various padding modes that can be used with AES encryption. For example, with .NET we can choose PKCS7, ISO10126, ANSIX923, Zeros or None.
I ...
9
votes
3answers
548 views
Why does the padding in MD5 contain the message length?
I understand the need for padding in MD5. But why do we append the message length to the padding?
I heard it strengthens the hash but how?
Please provide an example if possible and how it applies to ...
6
votes
2answers
269 views
What is the key strength reduction encrypting only 160 bits of data using RSA1024 for signatures
I am attempting to determine the strength of an incorrectly implemented 1024 bit RSA signature scheme. The weakness in the implementation is that the padding data lacks random numbers. As a result, ...
5
votes
3answers
428 views
Is RSA padding needed for single recipient, one-time, unique random message?
I want a way to encrypt files using this process: http://crypto.stackexchange.com/a/15 . That is: generate a random password, use that to AES-encrypt a file, and use an RSA public key to encrypt the ...
5
votes
3answers
936 views
In the SHA hash algorithm, why is the message always padded?
In the SHA hash algorithm the message is always padded, even if initially the correct length without padding; the padding is of the form "1" followed by the necessary number of 0s.
Why is it ...
5
votes
1answer
401 views
Why was ISO10126 Padding Withdrawn?
Wikipedia mentions ISO10126 Padding has been withdrawn, but doesn't say why. Also there were no news reports about this, as far as I can see.
Why was it withdrawn? Are there security flaws? Is there ...
5
votes
1answer
360 views
RSA-OAEP Input Parameters
When creating padding for RSA using OAEP, a message is prepared as follows:
Hash(Input Parameter) || Zeros || 1 || Message
My question is, what should the Input ...
4
votes
2answers
297 views
Does RSA padding have to be unpredictable if the payload is?
I'm trying to understand the precise requirements on padding when using RSA for encryption.
Suppose Alice uses RSA to encrypt a payload $M$ that cannot be guessed (say, a random nonce): Alice send ...
4
votes
1answer
123 views
Why does OAEP have 2 rounds with 2 random oracles?
I strive into understanding why OAEP has two rounds of computations and not just one. I.e: Wouldn't it be safe to hash the random number r and XOR it with the original message?What security risks if ...
4
votes
1answer
479 views
How to securely use Elgamal encryption in libgcrypt?
How secure is libgcrypt's Elgamal implementation of encryption (how different it is from textbook Elgamal), and how can I tweak padding and other preprocessing actions?
For example, I know that usign ...
4
votes
1answer
495 views
Padding methods for block ciphers - PKCS7 vs ANSI X.923
I was looking through block cipher padding methods, and found two good candidates:
ANSI X.923 - pad with zeros, then a final byte for the padding length, e.g. ...
3
votes
2answers
189 views
RSA blind signatures in practice
Hi I have a problem with moving my blind signature implementation from educational (textbook RSA) to more practical (padded RSA) side.
David Chaums paper gives a following figure:
$r$ - blinding ...
2
votes
4answers
878 views
Why is padding used for RSA encryption given that it is not a block cipher?
In AES we use some padded bytes at end of message to fit 128/256
byte blocks. But as RSA is not a block cipher why is padding used?
Can the message size be any byte length (is the encrypting agent
...
2
votes
2answers
149 views
Is storing original file size in an encrypted file header a bad idea?
I'm encrypting a file using AES-256 in CBC mode. I'm padding to the 16-byte input multiple by using the PKCS#7 limit. The problem I'm currently having is that if I'm transferring or reading the ...
2
votes
1answer
81 views
How does OAEP improve the security of RSA?
The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$.
Does everybody (so also an adversary) know these functions?
If YES: How does it help the ...
2
votes
2answers
128 views
Chain several RSA encryptions without increasing the message size
I would like to be able to encrypt the output of RSA with RSA again without having the output grow in size over time.
In other words, I have some data $D_0$ which I want to encrypt with RSA: $D_1 = ...
2
votes
3answers
425 views
Hash function in PBKDF2
From this excellent answer I learned (correct me if I am wrong) that when writing a block cipher with say key size 128 bit, one has to pad the password given (variable size) so that it becomes exactly ...
2
votes
1answer
409 views
Is RSA of a random nonce with no padding safe?
Consider the following protocol: Bob has a private RSA key $B_{priv}$, and Alice knows the public key $B_{pub}$. Alice wants to send confidential messages to Bob (no integrity intended). To send a ...
2
votes
0answers
57 views
Implementing PKCS#7 Padding on a Stream of Unknown Length?
I have a fairly simple Python program using PyCrypto to use AES+CBC to encrypt a stream of input. In order to adhere to the 16-byte input size multiple, I've implemented PKCS#7 by hand. (While I know ...
1
vote
2answers
215 views
AES key padding
Is the initial AES key (expanded to the key schedule) byte padded if less than e.g. 16 bytes?
Is there a safe way of determining if decryption was successful (i.e. used the correct key)?
1
vote
1answer
117 views
Why does .NET's ECB mode implementation append a constant block to my ciphertext?
Consider the following code and output:
...
1
vote
1answer
89 views
Padding always the same, problem or not?
I need to transmit long encrypted messages to a smartcard over a limited capacity link so I need to fragment the messages somewhere before sending thzm.
My problem is that I split the message into ...
1
vote
1answer
125 views
How is block cipher padding verified for consistancy?
Under what circumstances is a decryption routine able to tell that the padding of a message is invalid? If a cipher text block where to be randomly modified, what is the probability that the padding ...
1
vote
2answers
102 views
Is semantic security important in a hybrid cryptosystem?
RSA doesn't provide semantic security when used unmodified, and neither does the commonly used PKCS#1 v.1.5 padding scheme for encryption.
Is this a problem for hybrid cryptosystems at all?
My ...
1
vote
0answers
63 views
Is OAEP reversible?
Given nothing more than some integer $m =$ OAEP($M$), is it possible to recover the original plaintext $M$? In other words, without being given the hash functions or the random string used for ...
0
votes
2answers
100 views
Is this how padding can work?
So for block ciphers you need a fixed size block.
If the plaintext length is not a multiple of the block length then you need to pad it.
One way you could do this is that for the last block you just ...
0
votes
1answer
398 views
Removing Padded Value in Decrypted Message
How to remove padded value in Decrypted Message?
I am using AES Algorithm..
ex:
this is the decrypted message..
"abcdefghijklmn "
there is a 2 space in that decrypted message which is equivalent ...
0
votes
1answer
96 views
Is there an efficient way to hide the encrypted plaintext length with a block cipher?
In block cipher modes of operation for encryption on input of a plaintext of $N$ blocks (We assume that the input size is always a multiple of the blockcipher mode: $N·16$ bytes) the size of the ...
0
votes
0answers
39 views
Padding in PMAC
How does padding in PMAC work? I have been told two stories: Firstly, I have been told that it works similar to CMAC padding, and secondly, I have been told that it does not need padding.
I find the ...
0
votes
0answers
50 views
why these specific values used to initialize ipad & opad in HMAC [duplicate]
Possible Duplicate:
What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do?
I'm reading the book Network Security Essentials written by William Stallings.
in this book,in ...
0
votes
0answers
70 views
Why do we always append padding bits in SHA-512? [duplicate]
Possible Duplicate:
In the SHA hash algorithm, why is the message always padded?
I'm reading the book Network Security Essentials written by William Stallings.
To create a message digest ...
