My question is about how the padding is formated in TLS1.0, 1.1, 1.2, 1.3

I came across the PKCS7 format for the padding:

somedatawith3bytesleft 03 03 03 
aaasomedatawith2bytesleft 02 02 
aaaaaasomedatawith1bytesleft 01

But when you read explanation on TLS padding you will see this :

somedatawith3bytesleft 02 02 02
aaasomedatawith2bytesleft 01 01
aaaaaasomedatawith1bytesleft 00

I'm curious about the reason to not follow the PKCS7 format. (maybe they follow another format but i don't see it on wikipedia)

  • 2
    $\begingroup$ This is for historical reasons. TLS uses the same formats as SSL 3.0, which was designed by Netscape back in the mid 1990's. $\endgroup$ Commented Mar 23, 2016 at 12:18
  • $\begingroup$ @HenrickHellström Could well be an answer in my opinion. mpgn: is there still padding in TLS 1.3? If it's all authenticated ciphers then CTR and streaming modes should be all that's left, and those don't require padding. In general bit padding is used within the hash methods / PRF's... $\endgroup$
    – Maarten Bodewes
    Commented Mar 23, 2016 at 16:28
  • $\begingroup$ WARNING: there are padding attacks on TLS protocol. Don't just decrypt with an algorithm that includes padding willy-nilly or you'll be in trouble! $\endgroup$
    – Maarten Bodewes
    Commented Mar 23, 2016 at 16:29


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.