0
$\begingroup$

I have a symmetric-key encryption scheme. I think the output from this scheme (MAC + IV + CBC ciphertext) should already be practically indistinguishable from random, but I would like to pad the output to an arbitrary number of bits and have it still look like noise (I will be using the output for steganography). It would also be fine to pad the input.

What is the best cipher to use for this?

It seems to be difficult to do with AES without putting a plaintext length somewhere in the output. Perhaps I could use a stream cipher where I can decrypt part of the message to find the length?

Improve this question
$\endgroup$
6
  • $\begingroup$ I like OAEP and the papers about it, others will say don't roll your own. $\endgroup$
    – daniel
    Commented Oct 31, 2017 at 8:16
  • $\begingroup$ What is the (atypical) purpose of padding the message? $\endgroup$
    – Paul Uszak
    Commented Nov 1, 2017 at 2:25
  • $\begingroup$ @PaulUszak In this case I'm encoding the message in the LSBs of an image. If the seemingly random bits were to suddenly stop partway though the image, it would be a dead giveaway that a secret message is present. $\endgroup$
    – Fax
    Commented Nov 2, 2017 at 2:39
  • $\begingroup$ A small flaw: ciphertext is 100% uniformly distributed. It's perfectly pseudo-random. The lsb of a natural photograph isn't at all. This will also be a dead giveaway to anyone looking for a message. And TIFF, PNG, BMP and GIF photographs are also suspicious as they should be JPEGs really. $\endgroup$
    – Paul Uszak
    Commented Nov 2, 2017 at 3:03
  • $\begingroup$ @PaulUszak Good point. I imagine that a photographic RAW file is pretty close to random LSB, but that does limit application a lot. Perhaps I could dilute the ciphertext across the image instead of padding it? $\endgroup$
    – Fax
    Commented Nov 2, 2017 at 22:41

1 Answer 1

Reset to default
0
$\begingroup$

After a bit of additional reading I realized that appending noise to the ciphertext doesn't affect decryption of the plaintext part. The solution is therefore quite simple:

Encrypt length + plaintext with AES, then pad the ciphertext with as many random bits as necessary. HMAC the result including the random bits.

To get the plaintext back, first validate the MAC, then trim the ciphertext down to the nearest AES block size. You can then decrypt the result back to length + plaintext + garbage.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.