Common cyphers where the plaintext is the same length as the cyphertext

Question

What are the common cyphers where the cyphertext is always the same length as the plaintext?

I can think of XOR cyphers, and letter-substitution cyphers, what others are there?

Answer 1

Any cipher or cipher mode that implements Format Preserving Encryption (FPE) - by definition.

NIST has created a US standard document called NIST Special Publication 800-38G: Recommendation for Block Cipher Modes of Operation: Methods for Format-Preserving Encryption. This document lists two modes of operation abbreviated as FF1 and FF3. These are format-preserving, Feistel-based encryption modes. FF1 was previously known as FFX[Radix] and FF2 as BPS.

---

Stream ciphers or stream cipher modes of operation have the same property, but they have the problem that they require a nonce or IV, which typically has to be send with the ciphertext unless the state is otherwise synchronized between the party doing the encryption / decryption.

ECB and CBC mode have the same property, but the plaintext needs to be a certain number of full blocks and padding should not be applied. ECB is insecure and CBC also requires an IV to be used.

Commonly disk encryption routines have the same property as well, but they may restrict the input to a specific sized chunks. ESSIV for instance uses a hash over the sector number and key to create an IV, sidestepping the issue that CBC requires an unpredictable IV.

So for symmetric ciphers / cipher modes this is a common property except that they often require an IV and sometimes padding. If the ciphertext also needs to authenticated then an additional authentication tag may be required as well.

---

Asymmetric ciphers commonly have to expand the ciphertext compared with the plaintext to be considered secure. RSA - for instance - could be used to have a ciphertext that is the same size as the plaintext, but the message space would have to be identical to the (randomly generated) modulus, and encrypting the values 0 and 1 would be completely insecure (because the modular exponentiation would not alter the plaintext message).