# How is original plain text length reconstructed after decryption under RSA?

So far I know the ciphered output length of RSA equals the modulus N.

If I have only a small block of data significantly smaller than N, is the rest of the input to RSA just zero padded?

How can deciphering be unique then?

For instance if I get back as a plaintext

P="XXXXXXXXXXXX000000000000000000000000000000000000000000000000000000....", how can I know, how many zeros had been in the original plain text: It could be

"XXXXXXXXXXXX" or also "XXXXXXXXXXXX000000" as well as "XXXXXXXXXXXX0"

All those plaintexts would give the same ciphered text after padding.

• Usually, paddings either include the length of the message, or more commonly (like PKCS 1.5) a marker marking the point between message and padding. In your case, one would typically append one 1-bit before filling up with zeroes, which wouldn't be safe due to the mathematic structure of RSA. Instead, one should use paddings like OAEP. EDIT: Just saw @dade's answer :| – VincBreaker Jan 15 '18 at 18:53

Most importantly, note that for almost all practical applications textbook RSA should not be used to encrypt something. It does not yield an encryption scheme which provides the guarantees one would expect in practice. In particular it does not even provide security against chosen plaintext attacks (IND-CPA).