Skip to main content
Cryptography

Return to Answer

added 79 characters in body
Source Link
Maarten Bodewes ♦
Maarten Bodewes ♦
  • 94.5k
  • 13
  • 165
  • 319

PKCS#5/7SSL padding always pads, using 1..blocksize bytes (8 bytes for triple DES, 16 for AES). This padding makes it deterministic independently of the value of the plaintext. It's a padding mode similar to ISO 10126 (only the last padding byte is one less).

Other padding values - such as the zero padding performed by PHP's mcrypt library - are also deterministic, but they require the plaintext never to end with a 00 byte value. If you know the length in advance, then you could of course use any kind of padding and just toss away the spurious bytes.

Note that padding is only required for CBC and ECB modes of operation (at least for the popular modes of operation), and that for CBC ciphertext stealing could be deployed as well. Currently CTR is becoming more popular (it is also used in most authenticated modes of encryption), and it doesn't require padding.

Note that the Poodle attack is a padding oracle attack. This attack is not possible if the ciphertext is integrity protected. SSL however uses MAC-then-encrypt, which makes the CBC mode of operation vulnerable.

PKCS#5/7 padding always pads, using 1..blocksize bytes (8 bytes for triple DES, 16 for AES). This padding makes it deterministic independently of the value of the plaintext.

Other padding values - such as the zero padding performed by PHP's mcrypt library - are also deterministic, but they require the plaintext never to end with a 00 byte value. If you know the length in advance, then you could of course use any kind of padding and just toss away the spurious bytes.

Note that padding is only required for CBC and ECB modes of operation (at least for the popular modes of operation), and that for CBC ciphertext stealing could be deployed as well. Currently CTR is becoming more popular (it is also used in most authenticated modes of encryption), and it doesn't require padding.

Note that the Poodle attack is a padding oracle attack. This attack is not possible if the ciphertext is integrity protected. SSL however uses MAC-then-encrypt, which makes the CBC mode of operation vulnerable.

SSL padding always pads, using 1..blocksize bytes (8 bytes for triple DES, 16 for AES). This padding makes it deterministic independently of the value of the plaintext. It's a padding mode similar to ISO 10126 (only the last padding byte is one less).

Other padding values - such as the zero padding performed by PHP's mcrypt library - are also deterministic, but they require the plaintext never to end with a 00 byte value. If you know the length in advance, then you could of course use any kind of padding and just toss away the spurious bytes.

Note that padding is only required for CBC and ECB modes of operation (at least for the popular modes of operation), and that for CBC ciphertext stealing could be deployed as well. Currently CTR is becoming more popular (it is also used in most authenticated modes of encryption), and it doesn't require padding.

Note that the Poodle attack is a padding oracle attack. This attack is not possible if the ciphertext is integrity protected. SSL however uses MAC-then-encrypt, which makes the CBC mode of operation vulnerable.

Source Link
Maarten Bodewes ♦
Maarten Bodewes ♦
  • 94.5k
  • 13
  • 165
  • 319

PKCS#5/7 padding always pads, using 1..blocksize bytes (8 bytes for triple DES, 16 for AES). This padding makes it deterministic independently of the value of the plaintext.

Other padding values - such as the zero padding performed by PHP's mcrypt library - are also deterministic, but they require the plaintext never to end with a 00 byte value. If you know the length in advance, then you could of course use any kind of padding and just toss away the spurious bytes.

Note that padding is only required for CBC and ECB modes of operation (at least for the popular modes of operation), and that for CBC ciphertext stealing could be deployed as well. Currently CTR is becoming more popular (it is also used in most authenticated modes of encryption), and it doesn't require padding.

Note that the Poodle attack is a padding oracle attack. This attack is not possible if the ciphertext is integrity protected. SSL however uses MAC-then-encrypt, which makes the CBC mode of operation vulnerable.