In this example ( https://kavaliro.com/wp-content/uploads/2014/03/AES.pdf ), the AES-128 key and text are 16 characters each, but how would this example be explained if the key or text was more/less than 16 characters? How would this change the procedure that creates the encrypted text?

  • 2
    $\begingroup$ hint: Look at ECB and CBC and see padding then CTR with no padding. $\endgroup$ – kelalaka Feb 27 '19 at 20:35

AES is not a method of encrypting messages with passwords. It is a pseudorandom permutation family, which is not designed to be used directly by applications. Rather, a PRP is a very specific technical concept that cryptographers use to design methods of encrypting messages, called authenticated ciphers, like AES-GCM—and that cryptographers could use to derive keys from passwords, though usually we use other password-based key derivation functions like PBKDF2-SHA256 or scrypt or argon2id that don't involve AES.

For example, you could use scrypt to derive a 256-bit key $k$ from your password, and then encrypt your message $m$ using the authenticated cipher AES-GCM under the key $k$—or the even better authenticated cipher crypto_secretbox_xsalsa20poly1305 from NaCl which doesn't involve AES at all.

Don't use the letters A-E-S directly in your application; use an authenticated cipher. The keywords above should lead you to plenty of followup reading material.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.