In ECB and CBC mode, the size of cipher text is more than the plain-text size by one padding block.
Block ciphers can only permute plaintext blocks and produce the permuted output ciphertext blocks. As such, modes of operation are responsible to make sure that the messages in the target messages space can be encrypted and decrypted given this restriction.
Now for a generic cipher you would expect to be able to encrypt / decrypt any message or any size. ECB and CBC mode do not provide this functionality by themselves. They need to be paired with a deterministic padding mode such as PKCS#7 compatible padding to operate on messages of any size.
Such deterministic modes must at least add a single bit of padding as otherwise the padding cannot be distinguished from the last bit of the message. Therefore such deterministic padding modes add one bit to N bits of padding, where N is the block size.
For these deterministic modes a full "padding" block is added if the message is already a multiple of the block size. Otherwise the last block contains a mixture of the plaintext message and padding.
If a fully generic cipher is not required you can use many different methods:
- just requiring that the message size is a multiple of the block size (the key size of symmetric keys is often a multiple of the block size, so this often works for key wrapping);
- nondeterministic padding methods such as zero padding (where the message should commonly not end with zero bits, or contain the message size internally);
- ciphertext stealing, which poses constraints on the minimum message size / IV.
- many implementations are lazy and allocate a buffer size of the message size + 1 block for the ciphertext, this is however a waste of space.
- AES-192 keys are not a multiple of the block size, which makes key wrapping more awkward.
- deterministic modes require at least one padding bit, but usually implementations only handle bytes, so the padding would consist of 1..N/8 bytes.
- Most other modes (CTR, GCM, OFB, CFB) are streaming modes and do not require padding to be able to encrypt messages of any size.