Am I understanding AES key padding correctly?

Question

I’ld like to ensure I understand AES key padding correctly…

Is the initial AES key (expanded to the key schedule) byte padded if less than e.g. 16 bytes?
Is there a safe way of determining if decryption was successful (meaning: that the correct key has been used )?

CodesInChaos · Accepted Answer · 2012-11-15 21:27:46Z

8

AES by definition takes 16, 24 or 32 bytes as key, and nothing else. If you have a different size input use some kind of KDF to transform it to the correct length.

If that input is a password this step is even more important. You should a key strengthening construction, such as PBKDF2 with sufficient iterations and a salt.
If you use authenticated encryption, the verification of the authentication tag will fail if the key is incorrect. It's strongly recommended to use authenticated encryption. Not only will it tell you that the key is correct, it'll also prevent a variety of active attacks, such as padding oracles.

You can either use an authenticated mode, such as AES-GCM, or normal AES followed by HMAC (Encrypt then MAC).

answered Nov 15, 2012 at 21:27

CodesInChaos

25.1k2 gold badges90 silver badges129 bronze badges

$\begingroup$ The statement is that decryption will fail if the key is faulty, and this is correct. But authenticated encryption does not provide a method to test if the key is incorrect. A decryption failure will also occur if the ciphertext has been altered. $\endgroup$
– Maarten Bodewes ♦
Commented Nov 16, 2012 at 3:04
1

$\begingroup$ One caveat here with HMAC, if you use a separate MAC key, the MAC could check out just fine and the decryption be incorrect. This would happen if say the MAC key is correct, but the decryption key is incorrect. $\endgroup$
– mikeazo
Commented Nov 16, 2012 at 12:20
$\begingroup$ @mikeazo I avoid constructions with a non uniform key in most situations. I prefer some kind of hashing or KDF step in between. $\endgroup$
– CodesInChaos
Commented Nov 16, 2012 at 12:25
$\begingroup$ @CodesInChaos, right, that would be the proper way to do it (stackoverflow.com/questions/2501207/…) $\endgroup$
– mikeazo
Commented Nov 16, 2012 at 12:50

Add a comment |

e-sushi · Accepted Answer · 2016-06-10 11:38:53Z

3

If the key is too small, something like PBKDF2 should be used to expand the key to the proper size.
An authenticated encryption mode such as GCM can be used. It outputs an authentication tag which is sent to the receiver. If the decryption is incorrect, decryption will instead result in an error or a special symbol to signify this.

e-sushi

18.1k12 gold badges85 silver badges235 bronze badges

answered Nov 15, 2012 at 21:17

mikeazo

38.9k9 gold badges117 silver badges182 bronze badges

Add a comment |

2 Answers 2