I need to use AES-128 to encrypt a plain text about 720 bits.

Is it correct to say that – in this case – the plain text will be divided in 5 blocks of 128, the result will be equal 640 bits, and the other 80 bits would be expanded to 128 bits?

The total result would be 6 cryptograms( 5 - 128 bits, 1 - 80 bits expanded to 128 bits) that will be concatenated.

In the end, what I would like to know is: what's the correct procedure to standardize the plain text to be encrypted by algorithm?

  • $\begingroup$ en.wikipedia.org/wiki/Padding_(cryptography)#Bit_padding $\;$ $\endgroup$
    – user991
    Commented Jun 28, 2015 at 0:43
  • $\begingroup$ @RickyDemer PKCS#7 padding seems to be the industry default (I like bit padding better too). Please post an answer instead of putting an answer in a comment like this. $\endgroup$
    – Maarten Bodewes
    Commented Jun 28, 2015 at 12:10

1 Answer 1


You cannot encrypt 720 bits plaintext using just AES-128. AES is a 128 bit block cipher. Such a block cipher has an input of 128 bits of plaintext and an output of 128 bits ciphertext; and that's it. You need some kind of construction to make block ciphers encrypt larger or smaller plaintext.

Such constructions are known as (block cipher) modes of operation. Some of these constructs like ECB (usually insecure) or CBC require padding (what you call "expansion"), most of the others do not. Even ECB and CBC can be used with ciphertext-stealing to avoid padding.

Probably the best way is to chose a mode of operation that doesn't require padding; CTR mode operation is probably the most used mode for new implementations. It is also the most used within authenticated modes of operation such as GCM, which come highly recommended.

If you're stuck with ECB or CBC then choosing PKCS#7 compatible padding is probably the best / most compatible padding out there. Beware of padding oracle attacks though (did I mention authenticated encryption already?).

  • $\begingroup$ Thanks for your answer, Maarten. I understood the reason to use some constructs like ECB or CBC, but i keep confusing about how CTR dispenses padding. Could you explain to me? $\endgroup$ Commented Jun 29, 2015 at 1:21
  • 1
    $\begingroup$ @AlexRibeiro CTR produces the key stream by encrypting a sequence of counters. While you compute a key stream consisting of full blocks, you can simply discard the useless final bytes. CTR can do that, since it doesn't pass the ciphertext blocks to the blockcipher when decrypting, instead passing the same counters as when encrypting. $\endgroup$ Commented Jun 29, 2015 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.