# How is original plain text length reconstructed after decryption under RSA?

So far I know the ciphered output length of RSA equals the modulus N.

If I have only a small block of data significantly smaller than N, is the rest of the input to RSA just zero padded?

How can deciphering be unique then?

For instance if I get back as a plaintext

P="XXXXXXXXXXXX000000000000000000000000000000000000000000000000000000....", how can I know, how many zeros had been in the original plain text: It could be

"XXXXXXXXXXXX" or also "XXXXXXXXXXXX000000" as well as "XXXXXXXXXXXX0"

All those plaintexts would give the same ciphered text after padding.

• Usually, paddings either include the length of the message, or more commonly (like PKCS 1.5) a marker marking the point between message and padding. In your case, one would typically append one 1-bit before filling up with zeroes, which wouldn't be safe due to the mathematic structure of RSA. Instead, one should use paddings like OAEP. EDIT: Just saw @dade's answer :| Jan 15, 2018 at 18:53