I am trying to encrypt messages with the AES symmetric algorithm using C language.

I am using a key, an Initialization Vector (IV) and a plaintext, all with a length of 16 bytes.

I expected as output a ciphertext of 128 bit, instead it is of 256 bit. Can you explain me why?

  • $\begingroup$ There are two cases; IV appended to the ciphertext and/or the padding added an extra block. $\endgroup$
    – kelalaka
    May 8 at 19:12

ECB and CBC require padding or a scheme called ciphertext stealing if the size of the messages is not a multiple of the block size. Commonly a scheme such as PKCS#7 padding is applied, quite often by default (i.e. without you explicitly specifying it, e.g. OpenSSL defaults to PKCS#7 compatible padding).

Such padding schemes are created to apply for messages with any binary value. That means that if the size of the plaintext is identical to a multiple then the padding is applied nevertheless. The reason for this is that it is otherwise impossible to distinguish between the plaintext and possible padding. In your case that means that the input to CBC mode is a block of plaintext and another block of just padding.

If your message is always a multiple of 16 then you can use CBC without padding, usually by specifying this explicitly. If you use a scheme that only e.g. contains text strings that cannot end with a zero byte then you could use "zero padding". This is also useful for languages that use NUL-byte termination for the strings such as C. Beware, some implementations will always pad when using "zero padding" as well.

Ciphertext stealing is not used much, it could be used for messages longer than one block.

Finally, you could do without CBC altogether and use counter mode (CTR mode or SIC mode) or one of the authenticated ciphers based on it (GCM for instance).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.