8
$\begingroup$

Most block cipher implementations expect users to pad so that the message matches the cipher block size. I understand the purpose of the padding is to make the input match the cipher block size. It also has a the possibly beneficial effect of hiding the actual message length from the observer.

With NaCl secretbox, the documentation is explicit in stating "Note that the length is not hidden.". What exactly does that mean?

$\endgroup$
13
$\begingroup$

It is usually assumed that the length of the message is not secret. Even with padding the approximate length is leaked, and necessarily any encryption reveals a maximum length – or at least information content if compression is used – because the ciphertext cannot in general be shorter than the message.

NaCl's secretbox does not use a block cipher, but a stream cipher – XSalsa20 (pdf) – so it requires no padding and the exact message length is revealed.

If you have a situation where the message length should remain secret, you must ensure that yourself, e.g. by padding the message to a fixed maximum length. Doing that automatically would be wasteful and would limit the message size the algorithm could be used with, which is why it is left for the user.

$\endgroup$
  • 1
    $\begingroup$ Or you could pad the message to the next power of two. $\endgroup$ – Joshua Oct 19 '15 at 18:54
  • 1
    $\begingroup$ @Joshua: That is potentially a lot of padding, and it also gives an adversary both an upper and lower bound on the message length (though neither will be particularly tight in the average case). $\endgroup$ – Kevin Oct 20 '15 at 3:41
  • 1
    $\begingroup$ Depending on the requirements that could be good enough, but it would allow differentiating 'abort mission' from 'proceed as planned'. $\endgroup$ – otus Oct 20 '15 at 8:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.