I just designed my own padding function and came up with a potential problem that could harm the security of encryption. After I fixed that flaw, I found out that the PKCS7 standard padding should be also vulnerable to a known-plaintext attack. Please correct me if I am wrong at any point.
PKCS7 is filling each padded byte with the number of total bytes padded. Every time, at least one byte of padding is appended, in the worst case an entire block. When I am operating a cipher in the electronic code book mode, the last block could be easily guessed for a known-plaintext attack. (In 1 out of 16 [block size] cases, instantly) Example padding is shown below.
53 65 63 72 65 74 20 74 65 78 74 2e --> 53 65 63 72 65 74 20 74 65 78 74 2e 04 04 04 04
I figure that filling up all the padded bytes with random nonsense and the last byte with the number of padded bytes would be far more secure. Why isn't that the case in such a widely distributed padding standard? Isn't the example below more secure?
53 65 63 72 65 74 20 74 65 78 74 2e --> 53 65 63 72 65 74 20 74 65 78 74 2e 5a 2c 12 04
Thanks in advance.
CPA = Chosen Plaintext Attack
$\endgroup$ECB/nopadding
and apply your padding. Your padding only helps you if you have only one block that can eliminate equality, if you have more than 1 blocks, that doesn't help at all. $\endgroup$NoPadding
in Java, but you don't have to implement Padding yourself when using the only implemented paddingPKCS5
. Why isn't there another standard implementation? $\endgroup$