I am studying AES algorithm, as far as I know, encrypting a 16 bytes plaintext will result in a 16 bytes ciphertext. But I got a different result when trying to encrypt a 16 bytes plaintext using AES-128-CBC. I got a 32 bytes ciphertext instead

I went to this website https://legacy.cryptool.org/en/cto/aes-step-by-step I tried the AES-CBC-128 Test Vector#1:

algorithm: AES-128-CBC

plaintext: 6b c1 be e2 2e 40 9f 96 e9 3d 7e 11 73 93 17 2a

iv: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f

key: 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c

But the ciphertext output is

76 49 ab ac 81 19 b2 46 ce e9 8e 9b 12 e9 19 7d 89 64 e0 b1 49 c1 0b 7b 68 2e 6e 39 aa eb 73 1c

Why is the output 32 bytes long, I thought the output should be 16 bytes long? This also happens with other 16 bytes plaintext that I tried to encrypt.


1 Answer 1


CBC mode requires

  1. A nonce ( it was stated as IV for CBC but it is nonce - number used once);

    • so that we can have probabilistic encryption, i.e. even if we have the same plaintext and ciphertext we will have a different one. This is a must to achieve CPA security.
    • The nonce must be random and in the case of network it must be unpredictable.
    • The size of nonce is the block size of the block cipher, and in the case of AES, it is 16 bytes.
    • The nonce is commonly prepended ( as a prefix ) to the ciphertext ( tags are appended ). Separately sending them or forming a JSON object etc. is also possible.
  2. A padding;

    • A $b$ block sized cipher can output $b$ bits at once. Depending on the mode of operation, we may need padding.
    • CBC encrypted as $C_i = E(k, C_{i-1} \oplus P_i)$ with $C_0 = nonce$, we need full block-sized input ( plaintext) for the encryption algorithm.
    • The common way to pad for the CBC mode is the PKCS#7 padding
    • Padding is appended to plaintext before encryption.
  3. PKCS#7 padding;

    • The padding depends on the size of the plaintext $l$ on the last block. If the block size is $b$ then the padding is performed as
              01 -- if l mod b = b-1
           02 02 -- if l mod b = b-2
     b b ... b b -- if l mod b = 0
  1. Your case;

    • You have 16 bytes
    • This means that you have a full-size block. Due to the padding - the last line - we need an additional block full of 0x10 contributing to an additional one block encryption.
  2. Conclusion;

    • You had two ciphertext blocks which makes 32 bytes.
    • Your online sites don't include the nonce as the output. This a mistake. In general, without the nonce(IV), we cannot decrypt the ciphertext, well, in CBC mode only the first plaintext block cannot be decrypted.
    • 16 bytes nonce, 16 bytes plaintext, and 16 bytes padding make 48-byte output as the actual ciphertext size.
  • $\begingroup$ IME padding is always appended (i.e. at end) before encryption (i.e. to plaintext). IV/nonce is sometimes prepended and auth tag often appended to ciphertext, but both can instead be sent/stored separately and IV/nonce is sometimes implicit. The online site referenced (I haven't surveyed others) takes IV as input thus doesn't need to output it. $\endgroup$ Commented Jun 12 at 22:47
  • $\begingroup$ @dave_thompson_085 haha. Thanks for the notice. As usual.. $\endgroup$
    – kelalaka
    Commented Jun 12 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.