2
$\begingroup$

In block cipher modes of operation for encryption on input of a plaintext of $N$ blocks (We assume that the input size is always a multiple of the blockcipher mode: $N·16$ bytes) the size of the ciphertext is $N+1$, where the extra block is the IV.

Is there an efficient way to have fixed (parametrizable) larger length output on variable length input, to hide the plaintext size?

For example, for a short plaintext of $16$ or $20$ bytes I want to generate a larger ciphertext like 128 bytes, so an attacker can't learn the plaintext size from the ciphertext size.

The only way I can think of is just to produce pseudo-random pad to increase the plaintext message to equal the size of the ciphertext you want to output.

Improve this question
$\endgroup$
9
  • 2
    $\begingroup$ It is not clear what "variable length output on variable length input" is intended to mean. $\endgroup$
    – fgrieu ♦
    Mar 11, 2013 at 10:19
  • $\begingroup$ @fgrieu I.e: 16bytes of plaintext to 128*16bytes of ciphertext or to k*16bytes of ciphertext tuned by a parameter $k$ appropriately, given as input to the block cipher $\endgroup$
    – curious
    Mar 11, 2013 at 10:44
  • 2
    $\begingroup$ Definition by example is generally ambiguous. That example is parameterizable length output from fixed length input.Assuming you mean that an input of $b\ge1$ blocks cause an output length of $k\cdot b$ blocks for some parameter $k\ge2$: in the absence of other requirement, the solution outlined in the question (IV, ciphertext, and $(k-1)\cdot b-1$ blocks of randomness) seems as good as any of the many others. That's not generally studied, because cryptography rather tries to minimize the expansion of ciphertext. $\endgroup$
    – fgrieu ♦
    Mar 11, 2013 at 11:24
  • 1
    $\begingroup$ I don't get your question, but you can use AES-CTR as PRNG. Stream ciphers and the expansion part of a PRNG are essentially the same thing. But that way the only input will be the key. $\endgroup$
    – CodesInChaos
    Mar 11, 2013 at 20:58
  • 1
    $\begingroup$ @curious I edited your question to actually ask that – please review my change and feel free to edit again if I didn't totally hit the question. $\endgroup$
    – Paŭlo Ebermann
    Mar 13, 2013 at 22:18

1 Answer 1

Reset to default
1
$\begingroup$

Counter mode (CTR mode) seems like it will do what you want. The length of the output is equal to the length of the input, plus the length of the IV. If this is not what you want, you'll need to explain your question/requirements more clearly.

In practice, I recommend you use an authenticated-encryption mode, such as EAX or GCM etc.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.