1
$\begingroup$

I have a question about AES-256-GCM encryption.

Can I make a fixed-length encryption output?

In my understanding, I cannot make a fixed-length ciphertext. To me, the fixed-length output is much more secure so that no one can guess the input length. If we cannot make a fixed-length output, can someone explain why this is still secure enough?

$\endgroup$
  • $\begingroup$ Assuming the fixed length is long enough to accommodate all desired plain texts and the required authentication tags. $\endgroup$ – Swashbuckler Mar 7 at 17:32
4
$\begingroup$

Can I make a fixed-length encryption output?

Sure you can - on encryption, you can first pad out the plaintext to a fixed length (and then perform the GCM encryption). On decryption, you perform the GCM decryption, and then depad.

Obviously, the padding will need to contain a 'amount of padding I added' field (so that the depadding operation can remove the correct amount) - there are several obvious ways to accomplish that. Someone looking at the ciphertext cannot determine anything about the contents, including the pad length.

Because GCM does integrity checking (that is, if someone modifies the ciphertext, GCM will detect it), you don't have to worry about padding oracle attacks.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.