how calculate plaintext file size from length of encrypted one without decrypting

Question

Silly question – is it possible to find out size of original file from encrypted file? Encrypted with aes-128-cbc. Looks like there is no way to calculate it. As far as I understand ,all original files with length between let’s say 33 and 47 will have length 48 bytes after aes-128-cbc encryption (should be rounded to next 16 byte block). But, just in case asking the crowd 😊

Update: Well, I’m not mathematician, just a programmer, and the formula provided in an answer below means not much for me ☹ so I need more plain explanation how I could that. The story is - I encrypt files (longer than 48 bytes 😊) by using standard Node.js module (crypto). I ask this module to use aes-128-cbs algorithm (but, generally speaking, I could use others algorithms) and I know the key, the key length, the IV. Looks like I need to read last 2 blocks (32 bytes) of a encrypted file, give them to decipher, it will not be able to correctly decrypt penultimate block due to luck of IV, but should decrypt very last one. What I suppose to do with this data (last decrypted block)? How EXACTLY I can calculate size of original file knowing content of last block, the key, the key length etc? Thanks a lot in advance.

Answer 1

As far as I understand ,all original files with length between let’s say 33 and 47 will have length 48 bytes after aes-128-cbc encryption (should be rounded to next 16 byte block).

Actually, if you are using the standard padding pattern (and you don't count the space the IV takes up - you do use a different IV for each ciphertext, don't you), then the range of original plaintext strings will be 32-47; those will all encrypt to 48 bytes, and no one without the key can determine the original length.

However, if you do have the key, you can determine the length without decrypting the entire message; you only need to decrypt the last block - that is sufficient to determine the original length.

That last block is $P_n = C_{n-1} \oplus D_{key}( C_n )$.

For a 3 block message, the savings aren't huge; however if you are trying to determine the exact length of a multi-megabyte plaintext, the savings are more significant...

Answer 2

AES-CBC is generally used with PKCS#7 padding scheme where

• if one byte is missing 0x01 is padded 1 time
• if two bytes are missing 2 0x02 is padded 2 times
• if three bytes are missing 0x03 is padded 3 times
• ...
• if fifteen bytes are missing 0x0F is padded 15 times
• if the last block is full then an additional block is added with full of 0x10, i.e 16 times.

33 and 47-byte messages are in the range of 15-byte and 1-byte missing cases therefore they have 48-byte with PKCS#7 padding scheme.

If you see a ciphertext with 48-byte, then we have an additional case; the IV. Usually, the IV is prepended to the ciphertext that counts 16-bytes. Therefore the expected plaintext bytes are

• 16-byte IV and 16 to 31 bytes possible plaintext, or
• no IV and 32 to 47 bytes of plaintext.