Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I have a question about AES-256-GCM encryption.
Can I make a fixed-length encryption output?
In my understanding, I cannot make a fixed-length ciphertext. To me, the fixed-length output is much more secure so that no one can guess the input length. If we cannot make a fixed-length output, can someone explain why this is still secure enough?
Can I make a fixed-length encryption output?
Sure you can - on encryption, you can first pad out the plaintext to a fixed length (and then perform the GCM encryption). On decryption, you perform the GCM decryption, and then depad.
Obviously, the padding will need to contain a 'amount of padding I added' field (so that the depadding operation can remove the correct amount) - there are several obvious ways to accomplish that. Someone looking at the ciphertext cannot determine anything about the contents, including the pad length.
Because GCM does integrity checking (that is, if someone modifies the ciphertext, GCM will detect it), you don't have to worry about padding oracle attacks.
