I’ld like to ensure I understand AES key padding correctly…

  1. Is the initial AES key (expanded to the key schedule) byte padded if less than e.g. 16 bytes?
  2. Is there a safe way of determining if decryption was successful (meaning: that the correct key has been used )?

2 Answers 2

  1. AES by definition takes 16, 24 or 32 bytes as key, and nothing else. If you have a different size input use some kind of KDF to transform it to the correct length.

    If that input is a password this step is even more important. You should a key strengthening construction, such as PBKDF2 with sufficient iterations and a salt.

  2. If you use authenticated encryption, the verification of the authentication tag will fail if the key is incorrect. It's strongly recommended to use authenticated encryption. Not only will it tell you that the key is correct, it'll also prevent a variety of active attacks, such as padding oracles.

    You can either use an authenticated mode, such as AES-GCM, or normal AES followed by HMAC (Encrypt then MAC).

  • $\begingroup$ The statement is that decryption will fail if the key is faulty, and this is correct. But authenticated encryption does not provide a method to test if the key is incorrect. A decryption failure will also occur if the ciphertext has been altered. $\endgroup$
    – Maarten Bodewes
    Commented Nov 16, 2012 at 3:04
  • 1
    $\begingroup$ One caveat here with HMAC, if you use a separate MAC key, the MAC could check out just fine and the decryption be incorrect. This would happen if say the MAC key is correct, but the decryption key is incorrect. $\endgroup$
    – mikeazo
    Commented Nov 16, 2012 at 12:20
  • $\begingroup$ @mikeazo I avoid constructions with a non uniform key in most situations. I prefer some kind of hashing or KDF step in between. $\endgroup$ Commented Nov 16, 2012 at 12:25
  • $\begingroup$ @CodesInChaos, right, that would be the proper way to do it (stackoverflow.com/questions/2501207/…) $\endgroup$
    – mikeazo
    Commented Nov 16, 2012 at 12:50
  1. If the key is too small, something like PBKDF2 should be used to expand the key to the proper size.

  2. An authenticated encryption mode such as GCM can be used. It outputs an authentication tag which is sent to the receiver. If the decryption is incorrect, decryption will instead result in an error or a special symbol to signify this.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.