I understand that bit padding (add a 1, then 0's as needed) is a secure way to pad a message, preventing an unpadded message producing the same tag as a message that has been padded.

What I don't understand is how this works in practice. Surely a message exists that has a '1' bit followed by several trailing 0's. How does the system for a MAC distinguish between a regular message that naturally has a 1 and trailing 0's, and a padded message?


1 Answer 1


Bit padding is a padding that is always applied. So every possible message still has a canonical representation.

It is even possible to remove the padding always by removing all trailing zeros and the rightmost bit with value one.

For MAC calculation the unpadding is of course not used, but it shows that every message is still unique, even after the padding has been applied.

So if you have one message and you pad to a multiple of 8 bits (to make the example readable):

0000      -> pad -> 0000 1000

and a message that is identical to that padded message:

0000 1000 -> pad -> 0000 1000 1000 0000

as you can see the messages are still distinct after padding.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.