1
$\begingroup$

I noticed that when using AES-256-CBC with a 128-bit IV, the ciphertext is always at least 16 bytes long (size of IV).

I also noticed that when using AES-256-GCM with a 96-bit IV, the ciphertext size can be smaller than the IV.

Normal? Why?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
4
$\begingroup$

I noticed that when using AES-256-CBC with a 128-bit IV, the ciphertext is always at least 16 bytes long.

AES-256-CBC uses PKCS#7 padding means that one can have at most 16 extra bytes.

Usually one sees IV|ciphertext where ciphertext is the encryption of the padding block.

I also noticed that when using AES-256-GCM with a 96-bit IV, the ciphertext can be smaller than 12 bytes long.

AES-GCM uses CTR mode that doesn't require padding so the ciphertext is always equal to plaintext size.

Usually one sees IV|ciphertext|tag where the default tag is 16 bytes.

This is strange and really depends on the output of the software library.

Is it normal that cyphertext size can be smaller than IV when using AES-256-GCM?

If we only talking about the ciphertext, in CTR mode it is always equal to the plaintext size.

Semantically, however, the IV is part of the ciphertext since without it one cannot decrypt the ciphertexts completely - CBC lost only the first block whereas CTR lost all.

Improve this answer
$\endgroup$
3
  • $\begingroup$ “PKCS#7 padding” vs “CTR mode”… got it! Btw, I was referring to ciphertext as only the ciphertext version of plain text (not taking into consideration size of IV or auth tag). $\endgroup$
    – sunknudsen
    Commented Oct 26, 2022 at 10:20
  • 1
    $\begingroup$ I see, it should be #7 since #5 was only designed for 8-byte block sizes, though in Java they are the same and #7 enables for up to 256-byte block sizes. $\endgroup$
    – kelalaka
    Commented Oct 26, 2022 at 10:22
  • 1
    $\begingroup$ kelalaka: padding in original PKCS5 was only for 8-byte block, and PKCS7/CMS generalized it, but PKCS5v2.1 (in 2017) added AES and backported the CMS padding, so now both can properly be called by either name. I usually just say 'PKCS5/7 padding' (and ignore the differences between PKCS7 and CMS). We might also call it PKCS12 because 12 = 5 + 7, but, well, no, just no. $\endgroup$
    – dave_thompson_085
    Commented Oct 27, 2022 at 0:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.