Questions tagged [padding]

Padding has two primary uses in cryptography, ensuring messages are the proper length necessary for certain ciphers (e.g., block ciphers) or to provide assurances not built into the core cipher (e.g., semantic security)

Filter by
Sorted by
Tagged with
0 votes
2 answers
45 views

NIST Keccak test vectors confusion

I was looking at the test vectors of keccak provided by NIST here https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines/example-values and specifically for these example inputs of ...
pro orp's user avatar
-1 votes
0 answers
26 views

Padding oracle attack with known padding length

I have a question regarding the padding oracle attack. When I search the Internet the attack it seems that everyone has the same way of performing it. We learned another way in class and I try to ...
katibthemathematician's user avatar
6 votes
2 answers
514 views

Message Authentication Code Padding Overview

I am confused about padding when using a Message Authentication Code (MAC). This paper suggests using a different key if the message is padded, and otherwise not, which really confused me. An example ...
Titanlord's user avatar
  • 2,264
3 votes
2 answers
123 views

How to handle padding when encrypting a value smaller than the block size

I want to encrypt numeric identifiers into ciphertexts that are deterministic and not too long. I am considering AES-128 in ECB mode to encrypt 64-bit integers. How should I pad the 64-bit integers, ...
Sjoerd's user avatar
  • 661
4 votes
1 answer
93 views

Is Bypassing Padding Verification in RSA-PSS Dangerous?

I am currently working on a project involving RSA-PSS (Probabilistic Signature Scheme) for digital signatures. While researching potential vulnerabilities, I came across the well-known Bleichenbacher ...
user113612's user avatar
0 votes
1 answer
76 views

How to get the rest of 10 bytes (from total 32 bytes plaintext) of plaintext from a 48 byte ciphertext using AES-128 when knowing 22B of plaintext?

I have a challenge in which I need to decrypt 32(?) bytes of plaintext, which by encryption resulted in 48 (this for sure) bytes of data. It's a black box challenge, but managed to figure out the ...
Sir Muffington's user avatar
2 votes
1 answer
764 views

CTF - AES Padding Oracle [closed]

I am trying to solve another CTF challenge. The challenge consists in trying to exploit an oracle that decrypts any hex text we send (see code below). I am kind of stuck on this one as this is not a ...
Shark44's user avatar
  • 145
3 votes
1 answer
513 views

Weird padding in Crypto.Util.Padding.pad() function in python

I'm trying to pad some plaintext to be a multiple of 16 bytes to use it as input in AES ECB block cipher. ...
Ahmed Mohamed's user avatar
2 votes
0 answers
72 views

On the security of OAEP

I saw theorems stating that RSA-OAEP (or the similar variant OAEP+) is CCA-secure in the random oracle model. I wonder about the following: Is RSA-OAEP (or even OAEP+) CPA-secure in the plain model? ...
liavz123's user avatar
0 votes
1 answer
74 views

Regarding: Pseudorandomness, Pseudorandomgenerators and Padding

Hey there guys and gals, so I am right now studying topics regarding pseudorandomness. I was wondering why, for example with CBC-MAC oder a regular CBC blockcipher, we use padding instead of a PRG. ...
LePetit's user avatar
  • 15
-1 votes
1 answer
372 views

What is the correct value of SHA-512 message-length field if the message length is 3967 bits

In the steps of “Append the padding bits” in SHA-512 system, the message is padded so that its length is congruent to 896 mod 1024. I'm new to cryptography and I can't figure out the difference ...
SIDI's user avatar
  • 9
1 vote
1 answer
82 views

Cryptography particular block length valid message

I am new at cryptography and start to learn some terms. I just saw an question in the book and didn't got a clue about this question. Could someone can explain me the answer of this question? Because ...
MariaDb's user avatar
  • 31
0 votes
1 answer
125 views

Its Tls 1.2 Padding required when message ist multiple of block length?

When I want to encrypt a 16 byte long message with AES-128-CBC using int TLS 1.2 do I need to add a 16 byte block of padding or can I just encrypt the message without padding ?
atcheckmate's user avatar
2 votes
1 answer
880 views

Padding Oracle Attack - Decrypting First Block with Static IV

I'm trying to understand the exploitability of the padding oracle attack, which enables someone to decrypt and encrypt the contents without knowing the encryption key. Can encrypted data with the ...
VitoCorleone's user avatar
2 votes
1 answer
52 views

Can we pad witness of bulletproof and dory to be exponential size?

Bulletproof and dory reduce the witness size by a half during each interaction, until the witness is compressed to be only one element. But what about the witness is not precisely exponential size? ...
Walker's user avatar
  • 61
1 vote
1 answer
102 views

Textbook RSA security for fully random message

I am asking this since I can't find definite answer. Is it secure if I use textbook RSA provided all my data is 2048 bits ( or any N <=2048 for 2048 bit key ) and it is random ( using Secure Random ...
Jakub Rogacz's user avatar
2 votes
2 answers
396 views

Protecting against CPA for AES128/ECB by using padding

I was going to encrypt with AES, But I noticed ECB mode is not safe for CPA. So I thought about preventing CPA by padding input text to a multiple of 16 bytes. First, perform custom padding system: ...
kakacar's user avatar
  • 23
1 vote
1 answer
216 views

What is the recommended signature message padding for Ed448 in Bouncy Castle?

Bouncy Castle provides 6 different paddings for padding messages. However, I am not quite sure which one to choose from. ISO10126d2, ISO7816d4, PKCS7, TBC, X923, ZeroByte. Given that the native Bouncy ...
Hern's user avatar
  • 159
1 vote
0 answers
52 views

What are the possible CCA attacks on RSA with r||m+G(r) as the padding?

I was trying to come up with simple padding functions for the RSA, then trying to break them just to have a better understanding of why we need all the pieces used in the RSA OAEP... So, I am ...
Hilder Vitor Lima Pereira's user avatar
1 vote
1 answer
374 views

AES256-GCM padding for unaligned blocks

So I found some test vectors for my SSE implementation of AES256-GCM and unfortunately it seems that after the last step of AAD it goes wrong. My guess is that this is because the AAD is actually ...
Niels's user avatar
  • 23
2 votes
1 answer
139 views

How bad exactly are repetitions in the plaintext?

When the last n bytes of the plaintext are themselves suitably random, but predictably repeat m times in the same message - how bad is that? I'm convinced it is detrimental, but I am uncertain how ...
foo's user avatar
  • 144
1 vote
1 answer
162 views

I'm RSA-encrypting a randomly-created AES key. Do I need padding for the RSA?

There seem to be two ways to RSA-encrypt using .Net: EncryptValue (which doesn't seem to pad the plaintext). and Encrypt (which does). I was wondering, since what I'm encrypting is a cryptographically ...
ispiro's user avatar
  • 2,005
2 votes
1 answer
459 views

How does padding in RSA prevent existenial forgery attacks in RSA?

I am trying to understand how adding padding like the PKCS1.5 RSA signature scheme can prevent the existential forgery attack in RSA. Is it just by changing the structure of the message?
CryptoGuru's user avatar
1 vote
1 answer
294 views

Stream cipher padding

Problem example Let's say I have a plaintext with length of 50 bytes. I want to encrypt it using a stream encryption algorithm ChaCha20-Poly1305. Poly1305 generate a 128 bit hash (16 bytes), so ...
Ergo's user avatar
  • 23
0 votes
1 answer
233 views

Verify message digest of time stamp token

I'm trying to verify a time stamp token embedded into a PDF using the PDF 2.0 feature of the "Document Time-stamp Dictionary". The embedded time stamp token is exactly the token of a time ...
gettalong's user avatar
  • 101
1 vote
1 answer
405 views

KEY using AES-128, If P is less than 128 bits, padded with 0 and create 128 bits, any problem if average pw length is 6

For communication between the client and the website, use password (P) as the key using AES-128. If P is less than 128 bits, it is padded with 0 to create a 128 bits key. is there any problem with ...
lmmd1234's user avatar
1 vote
1 answer
208 views

Is it normal that cypertext size can be smaller than IV when using AES-256-GCM?

I noticed that when using AES-256-CBC with a 128-bit IV, the ciphertext is always at least 16 bytes long (size of IV). I also noticed that when using AES-256-GCM with a 96-bit IV, the ciphertext size ...
sunknudsen's user avatar
0 votes
2 answers
870 views

PKCS#7 SignedData - how is the "encryptedDigest" constructed for RSAES‐PKCS‐v1_5?

I need to use Azure Key Vault HSM to sign arbitrary data in a PKCS#7 CMS. There are plenty of libraries and packages that can do this if you supply them with the private key, but obviously I don't ...
user15045901's user avatar
1 vote
1 answer
187 views

Is it necessary to (length) pad a fixed length one time pad in the presence of a HMAC?

Imagine a protocol where all one time pad messages are of a fixed length. And they're textual only, à la Truths/Tweets. So a short message would be padded with spaces (ASCII 32) up to the protocol's ...
Paul Uszak's user avatar
  • 15.4k
2 votes
0 answers
80 views

Padding mechanism used in onion routing

I would like to get a correct understanding of the padding mechanism used in onion routing. The following is taken from the original paper of onion routing[https://www.onion-router.net/Publications/IH-...
Sangjin Kim's user avatar
2 votes
2 answers
2k views

AES output lengths are not always a multiple of 16

I have a C# solution that encrypts a bunch of small data chunks using AES. ...
Barak Gall's user avatar
2 votes
1 answer
386 views

What would be the disadvantages of very large block sizes in block ciphers?

Let's suppose someone creates a block cipher with 8192-bytes of the block size (65536-bits) or maybe 16384-bytes of the block size (131072-bits). What would be its disadvantages over a block cipher ...
phantomcraft's user avatar
1 vote
1 answer
321 views

On the correctness of the padding example of RFC 5246

The PKCS#7 padding is defined in rfc5652#section-6.3 Some content-encryption algorithms assume the input length is a multiple of k octets, where k is greater than one. For such algorithms, the input ...
kelalaka's user avatar
  • 48.5k
0 votes
1 answer
314 views

What's the difference between "padding" and "checksum" in cryptography?

In cryptography, padding is any of a number of distinct practices which all include adding data to the beginning, middle, or end of a message prior to encryption. In classical cryptography, padding ...
Sheldon's user avatar
  • 215
2 votes
0 answers
63 views

Prevent Bleichenbacher by adjusting Padding

I got the following question and I really don‘t know how to answer them. My I ask you for your input? Do you think, that the following adjusted Padding will prevent the classic Bleichenbacher attack <...
Random's user avatar
  • 21
1 vote
1 answer
1k views

Security of PKCS7 padding

I just designed my own padding function and came up with a potential problem that could harm the security of encryption. After I fixed that flaw, I found out that the PKCS7 standard padding should be ...
Luqus's user avatar
  • 37
1 vote
2 answers
574 views

OPENSSL: What is the difference of enc command and cms' enc command?

I found something strange while checking the inside of the envelope data. I had plain text "plaintextplant" - length is $15$ (include lf(0x0A))`. I made a ...
poiuy925's user avatar
1 vote
1 answer
100 views

Revealing original message length having random padding

If I have a message that has a fixed unknown length $L$, and we add to it's TLS encryption a random sized padding $0\leq n \leq N$ so the sent message if $L+n$. I'm also able to make the target re-...
Lee's user avatar
  • 153
2 votes
1 answer
2k views

What is the main problem with zero padding for AES key?

I am trying to understand the logic behind some basic principles of AES key padding. Why do we use different kinds of AES key padding schemes instead of the simplest zero-padding? Take AES-128 for ...
Terry TS Wong's user avatar
1 vote
0 answers
195 views

How to reproduce seeds in Random Number Generator like WELL, KISS etc

I am curious about Padding the seeds of Random Number Generator. (I am sure that terminology, padding the seeds, is not correct. If someone knows the proper word, please let me know :) ) What is ...
TyeolRik's user avatar
  • 123
3 votes
2 answers
626 views

How are the instantiations of RSAES-OAEP and SHA*WithRSAEncryption different in practice?

For the spare-time project I had been working on, I'm evaluating the PKCS#1 padded RSA schemes for implementation. For PKCS#1 v1.5, encryption doesn't seem to require a hash function, and the ...
DannyNiu's user avatar
  • 9,216
-1 votes
1 answer
396 views

Padding and the MD5 algorithm

In MD5, if M=100, how can we perform padding on it and how many blocks are needed in each round? These are general questions for understanding padding and rounds.
harpreet's user avatar
2 votes
1 answer
737 views

What is the padding block actually in merkle damgård?

I'm studying up on Merkle Damgård construction for hashing and having some trouble understanding the "padding block", at the end of the message blocks. When you look it up it says that in ...
partyTuringFriend's user avatar
2 votes
1 answer
2k views

What is the 2021 Padding Recommendation for RSA?

What is the current, year 2021, padding Recommendation for RSA? PCKS1? 7? 11? OAEP?
Leonardo's user avatar
  • 187
11 votes
2 answers
3k views

Random data CBC padding scheme?

When using AES in CBC mode, padding is required when the last plaintext block has not the length required by the cipher. Let's say $k$ mode bytes would be required to fill the block. My idea was to ...
HerpDerpington's user avatar
3 votes
2 answers
143 views

Why does Merkle-Damgård hashing involve putting the padding at the end instead of at the start?

Pretty much the title. We have that $x$ is a prefix of $PAD(x)$, instead of being a suffix - was that an arbitrary choice or is there a reason for it? Thank you.
sunsetgreen's user avatar
0 votes
0 answers
791 views

Attack a RSA padding scheme that appends zeros

Imagine we implement RSA padding such that a number of byte zeros are appended to the message until its length is equal to 100 (i.e. 800 bits). Also, let's assume that the public exponent $e$ is equal ...
Ali's user avatar
  • 1
3 votes
1 answer
61 views

Is there any advantage using this kind of ROM-based randomized hashing in digital signatures?

The said randomized hasing is actually a sort of padding, and it goes like this: ...
DannyNiu's user avatar
  • 9,216
0 votes
1 answer
58 views

Small values with non-uniform distribution encoded as large values with uniform distribution

Given a non-uniformly distributed set of 32-bit values (for example), is there a way to reversibly encode each one as a 128-bit value (for example) where they'd be approximately uniformly distributed ...
softsedge's user avatar
1 vote
1 answer
154 views

Generating a SHA256 pkcs1v1.5 Blind RSA Signature using Chaum's Blind Signature Scheme

I am a noob to cryptography in the sense that I have only little understanding as to how RSA encryption schemes work in practice. However I do understand the theoretical foundations of RSA ...
Ev3ryDay1sL3gDay's user avatar

1
2 3 4 5
7