From What is the difference between PKCS#5 padding and PKCS#7 padding, I understand that PKCS#5 is defined for 8 byte block sizes. Does this rule it out as a padding option for AES since AES has a 16byte block size. I have seen some conflicting usages and would like to get a definitive answer
$\begingroup$
$\endgroup$
1
-
$\begingroup$ I sincerely hoped I covered this question with "Most cryptographic libraries use either PKCS#5 or PKCS#7 to define the same padding mechanism. Officially PKCS#7 would of course be the only correct one if block sizes other than 8 are used within the calculation." I'll make it more clear in the answer. $\endgroup$– Maarten Bodewes ♦Nov 2, 2013 at 13:24
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
3
PKCS5 padding is a narrowly defined subset of PKCS7 as per its specification.
PKCS7 padding is identical to PKCS5 when applied to an 8-byte block only.
The PKCS5 specification is actually defined only for DES, not 64-bit block ciphers in general.
However, PKCS5 by specification MUST created an invalid padding string when applied to a block size that is longer than 8 bytes, and where more than 8 bytes of padding are needed, since it explicitly defines the value 8 for the block size and divisor in bytes. If 9 bytes of padding are required, PKCS5 will create only 1 byte of padding with a value of 0x01.
That being said, I would suspect most in the wild implementations of PKCS5 padding actually use the block size of the cipher used rather than the predefined value, and it is certainly possible that application of padding will not cause an error. This is not hard to test.
So yes, it does rule out PKCS5 as a padding option for AES, or for any block cipher with a non 64-bit block (and technically for anything not DES or 3DES), but may sometimes work anyway.
answered Oct 25, 2013 at 7:52
-
1$\begingroup$ My context for this was that in the JVM, the cipher name used for AES is "AES/CBC/PKCS5Padding". But I guess internally PKCS7Padding is used $\endgroup$– bobbyOct 25, 2013 at 12:06
-
2$\begingroup$ Is is.
"PKCS5Padding"is probably used either out of convenience (as it already existed for DES) or to make it possible to use AES where previously DES or tripple DES was being used. Now maybe they should have added"PKCS7Padding"as an identifier to specify the padding. $\endgroup$– Maarten Bodewes ♦Nov 2, 2013 at 13:28 -
1$\begingroup$ I can confirm from attempting to decrypt Java AES/*/PKCS5 using OpenSSL (all the way back to 1.0.2) and CryptoPP that they will not work. Both flag the Java ciphertext as having invalid block padding. $\endgroup$– DanielSep 30, 2022 at 22:01