Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [padding]

Padding has two primary uses in cryptography, ensuring messages are the proper length necessary for certain ciphers (e.g., block ciphers) or to provide assurances not built into the core cipher (e.g., semantic security)

1
vote
1answer
20 views

SHA1 padding on length extension attack

I was recently trying to replicate a length extension attack on SHA1. I implemented the registers state and also the new padding implementation (with the whole of the message that I want to extend). ...
2
votes
2answers
50 views

Preferred SHA-2 hash algorithm for MGF1 in RSA

Does it make any difference to the security and efficiency if we use SHA-256 or SHA-512 for the Mask Generation Function MGF1 that generates the masking / padding within the OAEP encryption scheme and ...
1
vote
1answer
123 views

Help understanding how to decrypt cipher

I am trying to create a padding oracle attack to decrypt a cipher that is encrypted with cbc and PKCS#7 padding. My first step is just to try and decrypt the second block. I have read a lot about it,...
3
votes
1answer
344 views

How does padding oracle attack work with bytes larger than possible length?

I am trying to understand how the POODLE attack would actually be implemented. In the original security advisory from Möller, Duong and Kotowicz [POODLE 14] the following example is presented: ...
67
votes
1answer
94k views

What is the difference between PKCS#5 padding and PKCS#7 padding

One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The ...
3
votes
1answer
116 views

Is OAEP needed when encrypting a session (random) key using RSA?

My question is two parts: when encrypting a session key which is used to encrypt bulk data using a block cipher for example, is padding with OAEP really needed [i'm assuming the key is generated ...
15
votes
2answers
7k views

Which attacks are possible against raw/textbook RSA?

The PKCS#1 standard defines multiple padding schemes for signature generation/verification (EMSA-PSS and EMSA-PKCS1-v1_5), and encryption/decryption (EME-OAEP and the less safe EME-PKCS1-v1_5). ...
0
votes
0answers
48 views

Is this code vulnerable to a padding oracle attack? [migrated]

Isn't this code vulnerable to a padding oracle attack, because it will return if the padding is valid or not (CBC, Pkcs7)? The code is taken directly from microsoft webpage and can be run easily on a ...
7
votes
1answer
513 views

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

Bleichenbacher demonstrated a padding oracle attack against RSA implementations that follow the PKCS #1 v1.5. Through the years, there are various mitigation techniques developed as OAEP and limiting ...
1
vote
0answers
82 views

RSA low exponent with padded plain-text

Considering a case, when modulus is large and hard to factor, exponent e=3 and there is a cipher-text which is created by padding plain-text with ...
0
votes
1answer
143 views

Why do MD5 and SHA-3 use different padding schemes?

What is the rationale for the difference between MD5 and SHA-3 padding schemes? MD5 appends 10* and then the 64-bit message length in bits. SHA-3 appends 10*1. Why do they use different padding ...
8
votes
1answer
149 views

Adding parameters to sponge's capacity

Is it safe to XOR parameters like domain, length of the message or block counter into sponge's capacity or that gives attacker control over capacity? For example NORX XORs domain into capacity. Does ...
2
votes
2answers
14k views

What is the length field in SHA-512 padding?

If I am using SHA-512 on a message and need to determine the padding field and length field, how do I determine the length field? I think I understand the padding, but not the length field. For ...
0
votes
0answers
35 views

How padding works on SHA-3? [duplicate]

I'm studying SHA-3 and I dont understand quite a bit how the padding 10*1 works. Can someone explain me step by step how is it work? Also I know that on SHA3-512 r is 576. On the sponge construction ...
1
vote
1answer
175 views

Is OAEP reversible?

Given nothing more than some integer $m =$ OAEP($M$), is it possible to recover the original plaintext $M$? In other words, without being given the hash functions or the random string used for ...
1
vote
3answers
7k views

Can we calculate AES-CBC-PKCS7 ciphertext length based on the length of the plaintext?

I am currently using AES256 in CBC mode with PKCS7 Padding to encrypt some data. It seems like the output size is not always a power of two, which was what I expected. Is it possible to calculate the ...
1
vote
2answers
440 views

Padding to increase entropy and size of (otherwise) small JSON objects

Maybe this better fits, the security stackexchange... I'm building a web API. We want to enable some relatively simple encryption, instead of going full-blown OAuth2 (which frankly, IMO, sucks). So I ...
1
vote
0answers
54 views

Discrepancy in padding order between NORX specification and reference code

I have been working on implementing the NORX V3.0 authenticated encryption algorithm and I have run into a very confusing contradiction regarding the order in which padding and permutation are ...
3
votes
1answer
429 views

Bitwise method of generating r for RSA-KEM

It seems that RSA-KEM has a very troublesome method of generating the secret $r$. It seems that the random value needs to be in the range $0 \le r \le {n - 1}$. Now most cryptographic environments ...
3
votes
2answers
69 views

If OAEP is introducing randomness to encryption how could be ciphertext decrypted?

I was studying OAEP and see we introduce a random value $r$ when computing the padding. See the figure below from Wikipedia So if we are adding randomness to encryption, how could this ciphertext be ...
4
votes
2answers
507 views

How can I hash an input into an arbitrary domain point?

I am trying to implement a signature scheme involving RSA signing of a message digest generated by SHA-$256$. I want to hash the input into an RSA domain point instead of the fixed $256$ bit digest ...
0
votes
0answers
33 views

Mitigating leakage of asymmetric encryption scheme leaking the length of plaintext

Asymmetric encryption schemes do leak something about the encrypted plaintext: the length of the plaintext. How can this be mitigated? My solution: Padding the plaintext with some string of the ...
2
votes
2answers
135 views

Security of RSA for padding $\texttt{0x00|message|random_bytes}$

I've read this and this but I'm not understanding why padding a message with a simple random is not secure. For example, consider a 256 bytes modulus. We can agree that the first byte from the ...
2
votes
1answer
158 views

Why does FIPS 180-4 require the final padding block start with a 1?

From FIPS 180-4 § 5.1.1, the padding used for the SHA family of hashes begins with a binary 1, followed by a number of 0s, and finally a 64-bit representation of the message length: Suppose that the ...
2
votes
0answers
39 views

OAEP Hash function truncation

I am using OAEP in a project and I want the resulting number of bits (n) to be 288 bits. Most of the implementations online seem to be for 1024 bits and using SHA-256 and I was wondering if truncating ...
9
votes
2answers
1k views

How does PKCS 1.5 solve the insecureness of Textbook RSA?

As we know, Textbook RSA is not enough safe to use because of the following issues; Guessable plaintext problem Small $e$ issue I want to know how PKCS 1.5 solved these problems.
0
votes
0answers
28 views

Why Textbook RSA is not enough secure? [duplicate]

As I know, when there are very large prime numbers, it is so hard to factor the n to find primes and I do not get why it is not secure enough?
3
votes
1answer
570 views

AES-CBC Padding: Why always attach 16x 0x10 pad?

Why do we have to always attach a 16x 0x10 pad even though the last block is already at block-length?
1
vote
2answers
309 views

Why does adding PKCS#1 v1.5 padding make RSA encryption non-deterministic?

I'm quite a beginner to cryptography, but have been implementing some encryption according to a specification over the last few weeks using the PyCrypto library. I've discovered that when encrypting ...
1
vote
0answers
75 views

CCA attack on RSA padded with random oracle

I'm trying to do the ex 11.15 of the Katz-Lindell book. Consider the RSA-based encryption scheme in which a user encrypts a message $m ∈ $ {$0, 1$}$^l$ with respect to the public key $(N, e)$ by ...
1
vote
1answer
216 views

Why does RSA signature need padding?

Actually, I think I know why, but consider RSA2048 and SHA256. What about to, instead of padding, just use pbkdf2 with just 1 iteration to expand the 256bits hash to full 2048bits and use those ...
5
votes
2answers
535 views

Is semantic security important in a hybrid cryptosystem?

RSA doesn't provide semantic security when used unmodified, and neither does the commonly used PKCS#1 v.1.5 padding scheme for encryption. Is this a problem for hybrid cryptosystems at all? My ...
2
votes
1answer
45 views

Padding schemes reversal and space efficiency

My crypto course proposes the following padding schemes: $\operatorname{pad}(m) = m \mathbin\| 0^i$ $\operatorname{pad}(m) = m \mathbin\| 10^i$ $\operatorname{pad}(m) = m \mathbin\| 0^i \mathbin\| E(\...
1
vote
1answer
232 views

How much data can I encrypt with RSA before I need to change the key

How much data can be encrypted with the same RSA key before it has to be changed? I looking for the total amount of data that can be encrypted for a single key pair, not the maximum length of data ...
1
vote
3answers
1k views

Chosen Plaintext Attack on DES/AES

PERSON A sends messages to PERSON B using AES, CBC, PKCS5Padding with an IV that is incremented by one after each message. If PERSON Z knows that the first block of the plain-text of any message is ...
3
votes
1answer
126 views

Blowfish padding

I'm currently reverse engineering a binary that uses Blowfish. A sample input would be: 08 00 01 00 1C FB 19 00 When this data is encrypted and then decrypted, I ...
3
votes
2answers
692 views

Choice of padding scheme to prevent CBC padding oracle attacks?

I was watching a lecture about the padding oracle attack on CBC mode block ciphers, where the padding scheme used was PKCS#7. My question is can padding oracle attacks be prevented (without any use ...
2
votes
1answer
57 views

Usefulness of OAEP with ECC

Does OAEP make sense for use in an ECC ElGamal cryptosystem? The way I see it, OAEP makes questionable sense even for RSA because even though it's a "all or nothing" transformation, many RSA ...
3
votes
1answer
98 views

Can modular multiplicative inverse be used to create a secure cipher?

Let $N$ be a large number; and $(e, d, N)$ be a secret-key; where $e$ is a one-time random factor, and large enough (say the more or less the same number of bits as $N$), where $e < N$ and $e * d \...
5
votes
1answer
100 views

Random Masking of Padded RSA Ciphertext through homomorphism

I had asked a question related to this before: Oblivious Decryption: Decrypting with a private key, without knowing the message @rikhavshah has an answer, which I would like to discuss the security ...
1
vote
0answers
228 views

Textbook RSA Signature attacks (without message padding)

I have been reading as much as possible, but I haven't so far found anything exactly like what I'm looking for. I have a couple of questions (given what I know below): One, is it possible to find d? ...
2
votes
1answer
49 views

Why does bit padding work in practice in a message authentication code?

I understand that bit padding (add a 1, then 0's as needed) is a secure way to pad a message, preventing an unpadded message producing the same tag as a message that has been padded. What I don't ...
2
votes
2answers
387 views

Why PS does differ between PKCS1 v1.5 padding for signature and for encryption?

As you may know, PKCS#1 defines two different padding in it's v1.5 : one for signature and one for encryption. Here they are : The middle part is refered as PS in the standard. There is only one ...
3
votes
2answers
252 views

Usability of padding scheme in blinded RSA signature?

In Wikipedia's article on Blind signature, in the section Dangers of blind signing which describes RSA blinding attack one reads the following This attack works because in this blind signature ...
1
vote
1answer
547 views

How is the usual way of using PKCS5/7 when a weird data is given?

PKCS5/7 pads the remaining data elements with a binary representation of how many space requires padding. This is useful and compact but what should I do in the following sample scenario below ? ...
0
votes
1answer
202 views

Padding RSA with random number

I known the post from here and here regarding RSA padding. I still don't understand why simple addition of the message with an random number and then encrypting the result with plain RSA isn't secure. ...
2
votes
1answer
82 views

Why is a 1 added after the message input and before adding padding zeros (if necessary) when using SHA256 or RIPEMD160? [duplicate]

In preparing an input for SHA256 or RIPEMD-160 a single bit (1) is appended to the message before adding any necessary zero padding and before adding the bitlength (64 bits) to form 1 or more 512 bit ...
2
votes
2answers
358 views

Cannot understand Block Cipher example

I learned modern block cipher and saw this example. How many padding bits must be added to a message of 100 characters if 8-bit ASCII is used for encoding and the block cipher accepts blocks of ...
2
votes
1answer
66 views

Is it possible to unpad a file that is not padded

I used "AES/CBC/PKCS5Padding" to encrypt some files. But I did not provide any identifier to detect if the file is encrypted or not. Now one way to detect if a file ...
3
votes
1answer
233 views

What is ANSI X.923 padding standard?

Wikipedia defines ANSI X.923 padding as follows: In ANSI X.923 bytes filled with zeros are padded and the last byte defines the padding boundaries or the number of padded bytes. Example: In ...