Questions tagged [padding]

Padding has two primary uses in cryptography, ensuring messages are the proper length necessary for certain ciphers (e.g., block ciphers) or to provide assurances not built into the core cipher (e.g., semantic security)

Filter by
Sorted by
Tagged with
0
votes
0answers
53 views

Amount of padding required for a stream cipher with known block size [on hold]

If I have the size of the block and the size of the data input, how can I calculate the number of bits to the pad before the data entry process? I tried $2 ^ n$ ($n$ is a data input byte), but this ...
1
vote
1answer
65 views

SHA1 padding on length extension attack

I was recently trying to replicate a length extension attack on SHA1. I implemented the registers state and also the new padding implementation (with the whole of the message that I want to extend). ...
2
votes
2answers
63 views

Preferred SHA-2 hash algorithm for MGF1 in RSA

Does it make any difference to the security and efficiency if we use SHA-256 or SHA-512 for the Mask Generation Function MGF1 that generates the masking / padding within the OAEP encryption scheme and ...
1
vote
1answer
172 views

Help understanding how to decrypt cipher

I am trying to create a padding oracle attack to decrypt a cipher that is encrypted with cbc and PKCS#7 padding. My first step is just to try and decrypt the second block. I have read a lot about it,...
1
vote
0answers
83 views

RSA low exponent with padded plain-text

Considering a case, when modulus is large and hard to factor, exponent e=3 and there is a cipher-text which is created by padding plain-text with ...
0
votes
0answers
38 views

How padding works on SHA-3? [duplicate]

I'm studying SHA-3 and I dont understand quite a bit how the padding 10*1 works. Can someone explain me step by step how is it work? Also I know that on SHA3-512 r is 576. On the sponge construction ...
1
vote
0answers
54 views

Discrepancy in padding order between NORX specification and reference code

I have been working on implementing the NORX V3.0 authenticated encryption algorithm and I have run into a very confusing contradiction regarding the order in which padding and permutation are ...
3
votes
2answers
73 views

If OAEP is introducing randomness to encryption how could be ciphertext decrypted?

I was studying OAEP and see we introduce a random value $r$ when computing the padding. See the figure below from Wikipedia So if we are adding randomness to encryption, how could this ciphertext be ...
4
votes
2answers
512 views

How can I hash an input into an arbitrary domain point?

I am trying to implement a signature scheme involving RSA signing of a message digest generated by SHA-$256$. I want to hash the input into an RSA domain point instead of the fixed $256$ bit digest ...
0
votes
0answers
33 views

Mitigating leakage of asymmetric encryption scheme leaking the length of plaintext

Asymmetric encryption schemes do leak something about the encrypted plaintext: the length of the plaintext. How can this be mitigated? My solution: Padding the plaintext with some string of the ...
2
votes
2answers
147 views

Security of RSA for padding $\texttt{0x00|message|random_bytes}$

I've read this and this but I'm not understanding why padding a message with a simple random is not secure. For example, consider a 256 bytes modulus. We can agree that the first byte from the ...
2
votes
0answers
45 views

OAEP Hash function truncation

I am using OAEP in a project and I want the resulting number of bits (n) to be 288 bits. Most of the implementations online seem to be for 1024 bits and using SHA-256 and I was wondering if truncating ...
0
votes
0answers
30 views

Why Textbook RSA is not enough secure? [duplicate]

As I know, when there are very large prime numbers, it is so hard to factor the n to find primes and I do not get why it is not secure enough?
9
votes
2answers
1k views

How does PKCS 1.5 solve the insecureness of Textbook RSA?

As we know, Textbook RSA is not enough safe to use because of the following issues; Guessable plaintext problem Small $e$ issue I want to know how PKCS 1.5 solved these problems.
3
votes
1answer
631 views

AES-CBC Padding: Why always attach 16x 0x10 pad?

Why do we have to always attach a 16x 0x10 pad even though the last block is already at block-length?
2
votes
2answers
549 views

Why does adding PKCS#1 v1.5 padding make RSA encryption non-deterministic?

I'm quite a beginner to cryptography, but have been implementing some encryption according to a specification over the last few weeks using the PyCrypto library. I've discovered that when encrypting ...
1
vote
0answers
78 views

CCA attack on RSA padded with random oracle

I'm trying to do the ex 11.15 of the Katz-Lindell book. Consider the RSA-based encryption scheme in which a user encrypts a message $m ∈ $ {$0, 1$}$^l$ with respect to the public key $(N, e)$ by ...
1
vote
1answer
302 views

Why does RSA signature need padding?

Actually, I think I know why, but consider RSA2048 and SHA256. What about to, instead of padding, just use pbkdf2 with just 1 iteration to expand the 256bits hash to full 2048bits and use those ...
3
votes
1answer
124 views

Is OAEP needed when encrypting a session (random) key using RSA?

My question is two parts: when encrypting a session key which is used to encrypt bulk data using a block cipher for example, is padding with OAEP really needed [i'm assuming the key is generated ...
7
votes
1answer
598 views

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

Bleichenbacher demonstrated a padding oracle attack against RSA implementations that follow the PKCS #1 v1.5. Through the years, there are various mitigation techniques developed as OAEP and limiting ...
1
vote
1answer
258 views

How much data can I encrypt with RSA before I need to change the key

How much data can be encrypted with the same RSA key before it has to be changed? I looking for the total amount of data that can be encrypted for a single key pair, not the maximum length of data ...
2
votes
1answer
47 views

Padding schemes reversal and space efficiency

My crypto course proposes the following padding schemes: $\operatorname{pad}(m) = m \mathbin\| 0^i$ $\operatorname{pad}(m) = m \mathbin\| 10^i$ $\operatorname{pad}(m) = m \mathbin\| 0^i \mathbin\| E(\...
3
votes
1answer
142 views

Blowfish padding

I'm currently reverse engineering a binary that uses Blowfish. A sample input would be: 08 00 01 00 1C FB 19 00 When this data is encrypted and then decrypted, I ...
2
votes
1answer
64 views

Usefulness of OAEP with ECC

Does OAEP make sense for use in an ECC ElGamal cryptosystem? The way I see it, OAEP makes questionable sense even for RSA because even though it's a "all or nothing" transformation, many RSA ...
3
votes
1answer
100 views

Can modular multiplicative inverse be used to create a secure cipher?

Let $N$ be a large number; and $(e, d, N)$ be a secret-key; where $e$ is a one-time random factor, and large enough (say the more or less the same number of bits as $N$), where $e < N$ and $e * d \...
5
votes
1answer
104 views

Random Masking of Padded RSA Ciphertext through homomorphism

I had asked a question related to this before: Oblivious Decryption: Decrypting with a private key, without knowing the message @rikhavshah has an answer, which I would like to discuss the security ...
1
vote
0answers
272 views

Textbook RSA Signature attacks (without message padding)

I have been reading as much as possible, but I haven't so far found anything exactly like what I'm looking for. I have a couple of questions (given what I know below): One, is it possible to find d? ...
2
votes
1answer
54 views

Why does bit padding work in practice in a message authentication code?

I understand that bit padding (add a 1, then 0's as needed) is a secure way to pad a message, preventing an unpadded message producing the same tag as a message that has been padded. What I don't ...
3
votes
2answers
744 views

Choice of padding scheme to prevent CBC padding oracle attacks?

I was watching a lecture about the padding oracle attack on CBC mode block ciphers, where the padding scheme used was PKCS#7. My question is can padding oracle attacks be prevented (without any use ...
0
votes
1answer
223 views

Padding RSA with random number

I known the post from here and here regarding RSA padding. I still don't understand why simple addition of the message with an random number and then encrypting the result with plain RSA isn't secure. ...
2
votes
2answers
411 views

Cannot understand Block Cipher example

I learned modern block cipher and saw this example. How many padding bits must be added to a message of 100 characters if 8-bit ASCII is used for encoding and the block cipher accepts blocks of ...
2
votes
1answer
74 views

Is it possible to unpad a file that is not padded

I used "AES/CBC/PKCS5Padding" to encrypt some files. But I did not provide any identifier to detect if the file is encrypted or not. Now one way to detect if a file ...
3
votes
1answer
280 views

What is ANSI X.923 padding standard?

Wikipedia defines ANSI X.923 padding as follows: In ANSI X.923 bytes filled with zeros are padded and the last byte defines the padding boundaries or the number of padded bytes. Example: In ...
2
votes
1answer
87 views

Why is a 1 added after the message input and before adding padding zeros (if necessary) when using SHA256 or RIPEMD160? [duplicate]

In preparing an input for SHA256 or RIPEMD-160 a single bit (1) is appended to the message before adding any necessary zero padding and before adding the bitlength (64 bits) to form 1 or more 512 bit ...
0
votes
1answer
199 views

Can I use PKCS#5 with CBC? [duplicate]

As far as I know there are two padding mechanisms, which are PKCS 5 and 7. Which one should be used for CBC?
1
vote
1answer
81 views

Cryptopals challenge - not understanding the padding details

I am working on some tasks in Crypto, specifically on this small task: https://cryptopals.com/sets/2/challenges/9, which I aim to implement in Python. The point is to add padding for a certain number ...
2
votes
2answers
451 views

Why PS does differ between PKCS1 v1.5 padding for signature and for encryption?

As you may know, PKCS#1 defines two different padding in it's v1.5 : one for signature and one for encryption. Here they are : The middle part is refered as PS in the standard. There is only one ...
1
vote
1answer
285 views

PKCS#7 non-detached Signature - Help understand the message structure

I am pretty new to ASN.1 format. I have a PKCS#7 signature which after doing an ASNdump looks like the one below. Can someone help me understand what each element below signifies? I could only ...
0
votes
1answer
121 views

Padding vs Hashing Encryption Key

I am making a program for personal use that will not contain super-sensitive information. I am using this to explore cryptography. Would it be acceptable to use a password to generate a key for AES, ...
1
vote
1answer
36 views

Encryption program conseil

I'm writing a little program to encrypt and decrypt a file. I'm using AES encryption in CTR mode that takes a key generated by a KDF (script). I have read some articles about cryptography but I have ...
1
vote
2answers
2k views

Understanding how padding works when using Block Cipher

I'm trying to understand how padding works when using block ciphers. Padding may be required when the size of the plain text is not a multiple of the block size If that's so, then I don't ...
2
votes
1answer
130 views

Can I work around these padding issue in AES 256 ECB due to Reed solomon encoding?

Disclaimer: I do NOT believe AES-ECB to be at all useful for encryption. That said, due to time and bureaucratic issues that I'm not in control of, I need to use AES-ECB. I get packets of data that ...
2
votes
1answer
129 views

OAEP Cryptanalysis

If $M_1$ and $M_2$ are $\operatorname{OAEP}$ padded, encrypted and sent and an adversary somehow manages to get around the encryption and retrieve $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(...
2
votes
1answer
158 views

Why is modulo being used for congruence in SHA-2 padding when the outcome is always the same?

I am reading up on SHA-2 algorithms and I came across this paper: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf In section 5.2.1 it talks about the formula for padding a message. There ...
2
votes
0answers
50 views

Rationale behind IETF-ChaChaPoly's padding during MAC computation [duplicate]

RFC 7539 (Section 2.8) specifies a ChaCha20/Poly1305 based AEAD cipher scheme; pseudocode: ...
2
votes
2answers
549 views

AES CBC: how shall i get to know with AES CBC method, the received Cipher Text is padded or not [closed]

Algorithm: AES - CBC mode with PKCS7 padding KeyValue: 10a58869d74be5a374cf867cfb473859 IV: ...
4
votes
1answer
211 views

How rare are 1024-bit $B$-smooth numbers?

What is the probability that if I choose a random $1 < r < n - 1$, $r^{65537} \pmod n$ will be $B$-smooth? $n$ is a 1024-bit RSA modulus. The Wikipedia pages on smooth numbers and the Dickman ...
2
votes
0answers
300 views

RSA signatures that allow hash to move around in block

I'm looking at a broken RSA signature padding implementation in a real device. It's a very-badly implemented version of PKCS #1-like encoding, but before PKCS added the DER-encoded hash identifier. ...
2
votes
1answer
167 views

Why does FIPS 180-4 require the final padding block start with a 1?

From FIPS 180-4 § 5.1.1, the padding used for the SHA family of hashes begins with a binary 1, followed by a number of 0s, and finally a 64-bit representation of the message length: Suppose that the ...
2
votes
1answer
386 views

How is original plain text length reconstructed after decryption under RSA?

So far I know the ciphered output length of RSA equals the modulus N. If I have only a small block of data significantly smaller than N, is the rest of the input to RSA just zero padded? How can ...