Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [padding]

Padding has two primary uses in cryptography, ensuring messages are the proper length necessary for certain ciphers (e.g., block ciphers) or to provide assurances not built into the core cipher (e.g., semantic security)

1
vote
1answer
56 views

How much data can I encrypt with RSA before I need to change the key

How much data can be encrypted with the same RSA key before it has to be changed? I looking for the total amount of data that can be encrypted for a single key pair, not the maximum length of data ...
2
votes
1answer
38 views

Padding schemes reversal and space efficiency

My crypto course proposes the following padding schemes: $\operatorname{pad}(m) = m \mathbin\| 0^i$ $\operatorname{pad}(m) = m \mathbin\| 10^i$ $\operatorname{pad}(m) = m \mathbin\| 0^i \mathbin\| E(\...
3
votes
1answer
79 views

Blowfish padding

I'm currently reverse engineering a binary that uses Blowfish. A sample input would be: 08 00 01 00 1C FB 19 00 When this data is encrypted and then decrypted, I ...
2
votes
1answer
52 views

Usefulness of OAEP with ECC

Does OAEP make sense for use in an ECC ElGamal cryptosystem? The way I see it, OAEP makes questionable sense even for RSA because even though it's a "all or nothing" transformation, many RSA ...
3
votes
1answer
82 views

Can modular multiplicative inverse be used to create a secure cipher?

Let $N$ be a large number; and $(e, d, N)$ be a secret-key; where $e$ is a one-time random factor, and large enough (say the more or less the same number of bits as $N$), where $e < N$ and $e * d \...
4
votes
1answer
83 views

Random Masking of Padded RSA Ciphertext through homomorphism

I had asked a question related to this before: Oblivious Decryption: Decrypting with a private key, without knowing the message @rikhavshah has an answer, which I would like to discuss the security ...
1
vote
0answers
94 views

Textbook RSA Signature attacks (without message padding)

I have been reading as much as possible, but I haven't so far found anything exactly like what I'm looking for. I have a couple of questions (given what I know below): One, is it possible to find d? ...
2
votes
1answer
42 views

Why does bit padding work in practice in a message authentication code?

I understand that bit padding (add a 1, then 0's as needed) is a secure way to pad a message, preventing an unpadded message producing the same tag as a message that has been padded. What I don't ...
3
votes
2answers
299 views

Choice of padding scheme to prevent CBC padding oracle attacks?

I was watching a lecture about the padding oracle attack on CBC mode block ciphers, where the padding scheme used was PKCS#7. My question is can padding oracle attacks be prevented (without any use ...
0
votes
1answer
88 views

Padding RSA with random number

I known the post from here and here regarding RSA padding. I still don't understand why simple addition of the message with an random number and then encrypting the result with plain RSA isn't secure. ...
2
votes
2answers
112 views

Cannot understand Block Cipher example

I learned modern block cipher and saw this example. How many padding bits must be added to a message of 100 characters if 8-bit ASCII is used for encoding and the block cipher accepts blocks of ...
2
votes
1answer
55 views

Is it possible to unpad a file that is not padded

I used "AES/CBC/PKCS5Padding" to encrypt some files. But I did not provide any identifier to detect if the file is encrypted or not. Now one way to detect if a file ...
3
votes
1answer
75 views

What is ANSI X.923 padding standard?

Wikipedia defines ANSI X.923 padding as follows: In ANSI X.923 bytes filled with zeros are padded and the last byte defines the padding boundaries or the number of padded bytes. Example: In ...
2
votes
1answer
65 views

Why is a 1 added after the message input and before adding padding zeros (if necessary) when using SHA256 or RIPEMD160? [duplicate]

In preparing an input for SHA256 or RIPEMD-160 a single bit (1) is appended to the message before adding any necessary zero padding and before adding the bitlength (64 bits) to form 1 or more 512 bit ...
0
votes
1answer
74 views

Can I use PKCS#5 with CBC? [duplicate]

As far as I know there are two padding mechanisms, which are PKCS 5 and 7. Which one should be used for CBC?
1
vote
1answer
40 views

Cryptopals challenge - not understanding the padding details

I am working on some tasks in Crypto, specifically on this small task: https://cryptopals.com/sets/2/challenges/9, which I aim to implement in Python. The point is to add padding for a certain number ...
2
votes
2answers
180 views

Why PS does differ between PKCS1 v1.5 padding for signature and for encryption?

As you may know, PKCS#1 defines two different padding in it's v1.5 : one for signature and one for encryption. Here they are : The middle part is refered as PS in the standard. There is only one ...
1
vote
1answer
111 views

PKCS#7 non-detached Signature - Help understand the message structure

I am pretty new to ASN.1 format. I have a PKCS#7 signature which after doing an ASNdump looks like the one below. Can someone help me understand what each element below signifies? I could only ...
0
votes
1answer
95 views

Padding vs Hashing Encryption Key

I am making a program for personal use that will not contain super-sensitive information. I am using this to explore cryptography. Would it be acceptable to use a password to generate a key for AES, ...
1
vote
1answer
30 views

Encryption program conseil

I'm writing a little program to encrypt and decrypt a file. I'm using AES encryption in CTR mode that takes a key generated by a KDF (script). I have read some articles about cryptography but I have ...
1
vote
2answers
422 views

Understanding how padding works when using Block Cipher

I'm trying to understand how padding works when using block ciphers. Padding may be required when the size of the plain text is not a multiple of the block size If that's so, then I don't ...
2
votes
1answer
77 views

Can I work around these padding issue in AES 256 ECB due to Reed solomon encoding?

Disclaimer: I do NOT believe AES-ECB to be at all useful for encryption. That said, due to time and bureaucratic issues that I'm not in control of, I need to use AES-ECB. I get packets of data that ...
2
votes
1answer
122 views

OAEP Cryptanalysis

If $M_1$ and $M_2$ are $\operatorname{OAEP}$ padded, encrypted and sent and an adversary somehow manages to get around the encryption and retrieve $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(...
2
votes
1answer
72 views

Why is modulo being used for congruence in SHA-2 padding when the outcome is always the same?

I am reading up on SHA-2 algorithms and I came across this paper: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf In section 5.2.1 it talks about the formula for padding a message. There ...
2
votes
0answers
47 views

Rationale behind IETF-ChaChaPoly's padding during MAC computation [duplicate]

RFC 7539 (Section 2.8) specifies a ChaCha20/Poly1305 based AEAD cipher scheme; pseudocode: ...
2
votes
2answers
433 views

AES CBC: how shall i get to know with AES CBC method, the received Cipher Text is padded or not [closed]

Algorithm: AES - CBC mode with PKCS7 padding KeyValue: 10a58869d74be5a374cf867cfb473859 IV: ...
4
votes
1answer
149 views

How rare are 1024-bit $B$-smooth numbers?

What is the probability that if I choose a random $1 < r < n - 1$, $r^{65537} \pmod n$ will be $B$-smooth? $n$ is a 1024-bit RSA modulus. The Wikipedia pages on smooth numbers and the Dickman ...
2
votes
0answers
286 views

RSA signatures that allow hash to move around in block

I'm looking at a broken RSA signature padding implementation in a real device. It's a very-badly implemented version of PKCS #1-like encoding, but before PKCS added the DER-encoded hash identifier. ...
2
votes
1answer
106 views

Why does FIPS-180-4 require the final padding block start with a 1?

From FIPS-180-4 § 5.1.1, the padding used for the SHA family of hashes begins with a binary 1, followed by a number of 0s, and finally a 64-bit representation of the message length: Suppose that the ...
2
votes
1answer
266 views

How is original plain text length reconstructed after decryption under RSA?

So far I know the ciphered output length of RSA equals the modulus N. If I have only a small block of data significantly smaller than N, is the rest of the input to RSA just zero padded? How can ...
1
vote
3answers
3k views

Can we calculate AES ciphertext length based on the length of the plaintext?

I am currently using AES256 in CBC mode with PKCS7 Padding to encrypt some data. It seems like the output size is not always a power of two, which was what I expected. Is it possible to calculate the ...
3
votes
1answer
138 views

Role of lHash field in RSAES-OAEP

The RSA encryption padding of RSAES-OAEP has a lHash field set to the hash of a label. That label is typically the empty string, or some public description of the intended use of the message. Does ...
1
vote
1answer
256 views

Is AES-CTR-NoPadding resistant to variable-length chosen-plaintext attack?

Consider the following scenario: an adversary $A$ with access to an encryption oracle $\mathcal{O}$ is able to choose $n \in \mathbb{N}$ and pick $p_1,\dots,p_n$ such that $\forall i \in \{1,\dots,n\}:...
1
vote
0answers
51 views

Security implications of plaintext-padding in an AEAD-scheme

Let's say I have a secure AEAD-scheme like ChaCha20/HMAC and my encrypted blobs need to match a fixed size: Is it OK to apply some padding to my plaintext to match the block-size? Can I use any ...
0
votes
1answer
106 views

What to do with a last chunk of 503 bits in SHA1?

I was trying to implement a SHA1 algorithm last night, and I got stuck at preprocessing the chunks in SHA1. As I have understood it, the message that has to be hashed, has to be broken into chunks of ...
7
votes
1answer
208 views

What encryption schemes to hide the plaintext length exist besides padding?

From this answers comments a statement came up about padding that I don't understand: "If we need to keep the length of the plaintext confidential to some degree, there are better methods." Are there ...
1
vote
1answer
228 views

Java - What are the additional 8 bytes of output generated by AES/CCM/NoPadding? [closed]

What are the additional 8 bytes of output used for in Java's (Bouncycastle) AES/CCM/NoPadding? I do not believe this is padding as I am requesting "NoPadding," and ...
0
votes
1answer
137 views

Need help with padding

I'm programming a file encryption software based on blowfish (which uses 64bit blocks). I will need a mechanism for padding, but I'm not sure how to implement that properly. All of the approaches I've ...
1
vote
1answer
359 views

Security of RSA signature using PKCS 1.5

I'm using mbedTLS to generate RSA signatures, and using PKCS 1.5 I get consistent signature output. I wanted to ask/confirm here that this is secure? There's surely got to be a reason for the PSS ...
-1
votes
1answer
718 views

How to perform the padding oracle attack on AES CBC?

Assume I am the attacker. I want to break the plaintext by performing the padding oracle attack on AES CBC mode. I know the following information: ...
0
votes
1answer
79 views

For TLS AES_CCM mode how does CBC_MAC work when the message length is not aligned to block size?

Even after goign through lot of specs I failed to understand how CBC-MAC works, specifically in case we have message not aligned to 16 bytes. Are there any padding bytes?
3
votes
1answer
889 views

How to encrypt the number one using RSA?

for example: if we have public key : (5,221) and private key : (77,221) and we want to encrypt 1: c(m) = (m)^p mod n c(m)=(1)^77 mod 21 =1 so how to deal with ...
2
votes
0answers
108 views

Estonian e-voting, vote verification system

I believe I do understand basics of how Estonian e-voting system work, but I'm stuck at their vote verification system. In order to get the vote verified, client needs to encrypt all of the possible ...
0
votes
1answer
159 views

Md compliment padding

What padding algorithms are there that are MD-compliment so two different inputs don't pad to the same thing? Which would cause a collision in a hash function.
0
votes
1answer
81 views

Different literature padding for Merkle-Damgard

I don't think this question addresses what I want to ask. I was taught that the Merkle Damgard scheme worked as in this picture: Here I assume that we are inserting a pad in filling the last block of ...
-2
votes
1answer
74 views

Increasing the brute force search time by repeatedly using an an all-or-nothing transform as padding [closed]

I'll explain some extra steps I'd like add to the example given in this document, to further slow down each brute force key attempt, and then you guys can tell me why it wouldn't work. As an ...
3
votes
1answer
50 views

Does the exact distribution of padding bytes in PKCSv1.5 type 1 matter?

[Disclaimer: I am fully aware PKCSv1.5 is horrible and should die (though tell that to the TLS v1.2 specification). I am asking this question for my own edification.] PKCSv1.5 encryption padding (as ...
1
vote
0answers
109 views

Reasons of the choice of padding scheme

Can you explain me what is the reason of the difference between MD5 and SHA-3 padding schemes? - MD5 has a padding scheme: 10*-message length 64 bit- - SHA-3 has a padding scheme: 10*1 Why they use ...
2
votes
1answer
5k views

How much safer is RSA-OAEP compared to RSA with PKCS#1 v1.5 padding?

Is there a way to calculate how much safer RSA-OAEP is compared to RSA with PKCS#1 v1.5 compliant padding? Or is there a good rule of thumb?
7
votes
1answer
430 views

Why does SHA-2 call for doing 10* padding in addition to appending the message length?

Appending the length of the message when padding of a SHA-2 message is sufficient to satisfy the Merkle-Damgård construction. However the padding in SHA-2 also pads with 10* between the end of the ...