So far I know the ciphered output length of RSA equals the modulus N.

If I have only a small block of data significantly smaller than N, is the rest of the input to RSA just zero padded?

How can deciphering be unique then?

For instance if I get back as a plaintext

P="XXXXXXXXXXXX000000000000000000000000000000000000000000000000000000....", how can I know, how many zeros had been in the original plain text: It could be


All those plaintexts would give the same ciphered text after padding.

  • 2
    $\begingroup$ Usually, paddings either include the length of the message, or more commonly (like PKCS 1.5) a marker marking the point between message and padding. In your case, one would typically append one 1-bit before filling up with zeroes, which wouldn't be safe due to the mathematic structure of RSA. Instead, one should use paddings like OAEP. EDIT: Just saw @dade's answer :| $\endgroup$ Jan 15, 2018 at 18:53

1 Answer 1


Most importantly, note that for almost all practical applications textbook RSA should not be used to encrypt something. It does not yield an encryption scheme which provides the guarantees one would expect in practice. In particular it does not even provide security against chosen plaintext attacks (IND-CPA).

Instead one would use some padding scheme such as optimal asymmetric encryption padding (OAEP).

Despite the fact that the usage of RSA you describe should not be used in practice, you would typically not pad "XXXXXXXXXXXX" as "XXXXXXXXXXXX000000....". Instead, you would encode "XXXXXXXXXXXX" as a number between 1 and N and use this upon encryption (i.e., you only implicitly prefix it with zeroes).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.