I am encrypting buffers using AES-256-CTR encryption. My encryption is working but I have a requirement that I want to make sure I implement correctly. The requirement is as follows:

Given any plaintext of length less that x, the ciphertext should always be of length x.

In my example

  • x is 1 KB but can be anything while consistent.
  • The plaintext could range between 1 byte to 1 KB, never larger.
  • The length of the plaintext is not know by decryptor.
  • $\begingroup$ This is tricky (possibly impossible) to implement if an exactly 1kB message must encrypt to an exactly 1kB output. What behavior is expected for blocks that are close to the limit, and what should happen for blocks larger than the limit? (Should a 1.5kB block be 2kB or ~1.5kB?) I'm assuming that the decryptor will not have access to the actual length by any other means than reading the ciphertext. $\endgroup$
    – Rob Napier
    May 12, 2018 at 17:23
  • 1
    $\begingroup$ @RobNapier The x does not need to be limited by exactly 1KB and can be any size while its consistent. Blocks larger than x will not be candidates, for shorter plaintext is the question. Decryptor will not have access to the actual length than the ciphertext. Thank you for the questions, I will update the question. $\endgroup$
    – Thor
    May 12, 2018 at 17:56
  • $\begingroup$ @MaartenBodewes, I might have misunderstood your point earlier and you are probably right, I am looking for the approach, not a block of code to copy-paste. Would you mind posting your approach with nodejs implementation in mind? No need to be runnable code $\endgroup$
    – Thor
    May 12, 2018 at 18:40
  • $\begingroup$ @MaartenBodewes, thank you for the link, I would not identify it as a duplicate since I would never have been able to find this answer the way I was looking for it. I will use the message length in the beginning of the buffer approach. $\endgroup$
    – Thor
    May 12, 2018 at 22:49
  • $\begingroup$ Ok removed some more outdated comments. I'm fine with the question and answer here mods... $\endgroup$
    – Maarten Bodewes
    May 12, 2018 at 22:53

2 Answers 2


If you can give up two bytes (so the longest message is 1022 bytes long), then this can be straightforward.

Create a 1024-byte buffer. Make the first two bytes the length of the message. Then add the message. Then pad the rest of the buffer with random data. Random data is best here because it leaks less information than zeros, but you could use zeros.

Encrypt the entire buffer. When you decrypt the result, pull the first two bytes and use that to extract the right number of bytes.

This of course will work for any length; so if you need a full 1024-byte message, you can just make the ciphertext always be 1026 bytes.


If I understand you correctly, you want to have a minimum size plaintext to cipher. This can be done with padding, eg, add bytes over and over under it reaches 1KB. The cipher will still have the original data in the beginning.

  • $\begingroup$ The programming language is not unclear, it's in the tags below the question, and by now in the question itself as well. $\endgroup$
    – Maarten Bodewes
    May 12, 2018 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.