Is there a standardized padding scheme which is prefix instead of postfix and that uses random bytes except for the first byte which would be the length of the padding?
$\begingroup$
$\endgroup$
8
-
$\begingroup$ universal padding $\endgroup$– fgrieu ♦Commented Oct 13, 2015 at 9:42
-
$\begingroup$ can't you apply a generic standard padding just to the front (like PKCS#7)? $\endgroup$– SEJPMCommented Oct 13, 2015 at 12:18
-
$\begingroup$ Why would you want to use such a padding? $\endgroup$– CodesInChaosCommented Oct 13, 2015 at 12:48
-
$\begingroup$ @CodesInChaos to make it hard for people to guess what was used to pad the message. $\endgroup$– darumaCommented Oct 13, 2015 at 13:32
-
$\begingroup$ @UnixJunkie And why is that useful? I don't see the point, assuming you're using semantically secure encryption. It sounds a bit like you're trying to shoehorn the padding into the role of an IV. $\endgroup$– CodesInChaosCommented Oct 13, 2015 at 13:34
|
Show 3 more comments
1 Answer
$\begingroup$
$\endgroup$
2
I know of no standard like that and also doubt it exists.
It would have similar disadvantages as random padding at the end, which is no longer in use: subliminal channel, consumption of randomness which may be expensive. Additionally, it would require knowing the message length in advance, which is a practical limitation.
-
$\begingroup$ Ok for the subliminal channel. For randomness, a CSPRNG can be used. Implemented properly, it would not require knowing the message length in advance but maybe prepend a full random block to messages which are composed of only full blocks. $\endgroup$– darumaCommented Oct 14, 2015 at 8:11
-
$\begingroup$ @UnixJunkie, even a CSPRNG takes time to generate randomness, compared to deterministic padding which takes a few cycles to verify. Regarding message length, unless you know it (modulo block size) you do not know how the block boundaries will fall, so you can't start encrypting. $\endgroup$– otusCommented Oct 14, 2015 at 9:27