Questions tagged [padding]
Padding has two primary uses in cryptography, ensuring messages are the proper length necessary for certain ciphers (e.g., block ciphers) or to provide assurances not built into the core cipher (e.g., semantic security)
319
questions
3
votes
1
answer
433
views
Role of lHash field in RSAES-OAEP
The RSA encryption padding of RSAES-OAEP has a lHash field set to the hash of a label. That label is typically the empty string, or some public description of the intended use of the message.
Does ...
- 141k
3
votes
1
answer
614
views
AEAD: Is it secure to decrypt the content encryption key before verifying the MAC?
The JSON Web Encryption (JWE) standard defines a number of encryption modes with the same basic form:
First, the a unique content encryption key (CEK) is generated and used to encrypt the payload ...
- 547
3
votes
1
answer
210
views
NORX duplex padding
MonkeyDuplex constructions defined by Keccak authors has padding in every duplex block.
Why only last duplex block is padded in NORX?
Is it because NORX has domain separation, or simply because ...
- 1,649
3
votes
1
answer
1k
views
How is an AES Encrypted Message Decrypted with Random Padding?
One thing I was surprised to learn about AES is that random padding can be added to the message to make it a multiple of block size. What I can not wrap my head around is how this random padding can ...
- 131
3
votes
2
answers
623
views
Chain several RSA encryptions without increasing the message size
I would like to be able to encrypt the output of RSA with RSA again without having the output grow in size over time.
In other words, I have some data $D_0$ which I want to encrypt with RSA: $D_1 = \...
3
votes
2
answers
120
views
How to handle padding when encrypting a value smaller than the block size
I want to encrypt numeric identifiers into ciphertexts that are deterministic and not too long. I am considering AES-128 in ECB mode to encrypt 64-bit integers. How should I pad the 64-bit integers, ...
- 661
3
votes
1
answer
501
views
Weird padding in Crypto.Util.Padding.pad() function in python
I'm trying to pad some plaintext to be a multiple of 16 bytes to use it as input in AES ECB block cipher.
...
3
votes
1
answer
61
views
Is there any advantage using this kind of ROM-based randomized hashing in digital signatures?
The said randomized hasing is actually a sort of padding, and it goes like this:
...
- 9,207
3
votes
1
answer
272
views
SHA3 hexadecimal paddig odd length string
Section B2 of FIPS-202 specification describes the Hexadecimal Form of Padding Bits which is basically the translation of the bit padding 0110*1. However at the beginning they suppose that the message ...
- 33
3
votes
1
answer
1k
views
AES-256, CBC, plaintext length is multiple of block size: Does PKCS #7 padding weaken the encryption?
Of course, padding is superfluous when AES with CBC is used if you know that the plaintext length is a multiple of the block size.
But does the padding precipitate a weakness in the encryption?
...
- 133
3
votes
1
answer
378
views
Is OAEP needed when encrypting a session (random) key using RSA?
My question is two parts:
when encrypting a session key which is used to encrypt bulk data using a block cipher for example, is padding with OAEP really needed [i'm assuming the key is generated ...
- 33
3
votes
1
answer
419
views
Can modular multiplicative inverse be used to create a secure cipher?
Let $N$ be a large number; and $(e, d, N)$ be a secret-key; where $e$ is a one-time random factor, and large enough (say the more or less the same number of bits as $N$), where $e < N$ and $e * d \...
- 591
3
votes
1
answer
2k
views
Attack RSA with PKCSv1.5 padding
I was reading an article about breaking RSA with PKCSv1.5 padding (http://mslc.ctf.su/wp/google-ctf-spotted-wobbegong-crypto-100/).
It says that while retrieving the message we multiply by the ...
- 365
3
votes
3
answers
572
views
Why not put MAC in fixed position and cover padding for MAC-then-encrypt?
The biggest problem with using MtE with a mode where it's known to be secure (CBC) is with the padding, where you can't retrieve the authentication until you know where it is by looking at the padding ...
- 829
3
votes
2
answers
619
views
How are the instantiations of RSAES-OAEP and SHA*WithRSAEncryption different in practice?
For the spare-time project I had been working on, I'm evaluating the PKCS#1 padded RSA schemes for implementation.
For PKCS#1 v1.5, encryption doesn't seem to require a hash function, and the ...
- 9,207
3
votes
1
answer
491
views
Signing a GPG Public Key
I am trying to manually create a GPG Public Key (see here). I am able to generate a GPG Public Key with a correct hash, but fail to RSA-sign that hash in a way that is accepted by the GPG CLI. For the ...
- 193
3
votes
1
answer
4k
views
Why does RSA signature need padding?
Actually, I think I know why, but consider RSA2048 and SHA256. What about to, instead of padding, just use pbkdf2 with just 1 iteration to expand the 256bits hash to full 2048bits and use those ...
- 600
3
votes
2
answers
2k
views
SHA-3 maximal number of zeros (Padding)
What is the maximum number of zeros, which are appended at the input- padding in messages? How large must the message be for this?
- 393
3
votes
1
answer
1k
views
Padding password before SHA-512 hashing to avoid info leak via timing
I've noticed that SHA-512 password hashing leaks some information about
the password length. There's a weak correlation between password length
and time to hash. It's roughly linear, but in steps of ...
- 328
3
votes
1
answer
646
views
How does padding oracle attack work with bytes larger than possible length?
I am trying to understand how the POODLE attack would actually be implemented. In the original security advisory from Möller, Duong and Kotowicz [POODLE 14] the following example is presented:
Assume ...
- 33
3
votes
1
answer
4k
views
Why does HMAC need a fixed length padding?
As everybody knows in order to calculate HMAC we have to concatenate padding to the message. I am just curious why the padding needs to be fixed-length. Why do we need the blocksize parameter here?
...
- 251
3
votes
1
answer
237
views
OMAC : Padding on empty string
I started to implement some MAC since last week with the specifications given here. I'm currently testing the OMAC (one-key CBC) with test vectors. In the OMAC specifications at page 4, they explain ...
- 297
3
votes
1
answer
4k
views
Is it true for Java that the transformation mode and padding is ignored when using RSA?
Consider GregS's comment to this question (more specific to bouncycastle's provider implementation):
https://stackoverflow.com/questions/11717646/bouncycastle-rsa-key-size-and-padding
The mode, ...
user8601
3
votes
1
answer
173
views
Does the exact distribution of padding bytes in PKCSv1.5 type 1 matter?
[Disclaimer: I am fully aware PKCSv1.5 is horrible and should die (though tell that to the TLS v1.2 specification). I am asking this question for my own edification.]
PKCSv1.5 encryption padding (as ...
- 1,694
3
votes
1
answer
550
views
Bitwise method of generating r for RSA-KEM
It seems that RSA-KEM has a very troublesome method of generating the secret $r$. It seems that the random value needs to be in the range $0 \le r \le {n - 1}$.
Now most cryptographic environments ...
- 92.6k
2
votes
1
answer
1k
views
How to encrypt the number one using RSA?
for example: if we have public key : (5,221) and private key : (77,221) and we want to encrypt 1:
c(m) = (m)^p mod n
c(m)=(1)^77 mod 21 =1
so how to deal with ...
- 121
2
votes
2
answers
1k
views
Security of RSA for padding $\texttt{0x00|message|random_bytes}$
I've read this and this but I'm not understanding why padding a message with a simple random is not secure.
For example, consider a 256 bytes modulus. We can agree that the first byte from the ...
- 327
2
votes
2
answers
6k
views
Am I understanding AES key padding correctly?
I’ld like to ensure I understand AES key padding correctly…
Is the initial AES key (expanded to the key schedule) byte padded if less than e.g. 16 bytes?
Is there a safe way of determining if ...
- 201
2
votes
2
answers
2k
views
Is storing original file size in an encrypted file header a bad idea?
I'm encrypting a file using AES-256 in CBC mode. I'm padding to the 16-byte input multiple by using the PKCS#7 limit. The problem I'm currently having is that if I'm transferring or reading the ...
- 967
2
votes
1
answer
26k
views
2
votes
1
answer
1k
views
Padding for the TEA
Having finally figured out how to implement the Tiny Encryption Algorithm in C++, I wonder what to do about padding the key and the plaintext.
I know that there are various ways of doing this, but is ...
- 1,174
2
votes
1
answer
461
views
Why does .NET's ECB mode implementation append a constant block to my ciphertext?
Consider the following code and output:
...
- 155
2
votes
2
answers
392
views
Protecting against CPA for AES128/ECB by using padding
I was going to encrypt with AES, But I noticed ECB mode is not safe for CPA.
So I thought about preventing CPA by padding input text to a multiple of 16 bytes.
First, perform custom padding system: ...
- 23
2
votes
1
answer
2k
views
What is the 2021 Padding Recommendation for RSA?
What is the current, year 2021, padding Recommendation for RSA? PCKS1? 7? 11? OAEP?
- 187
2
votes
2
answers
2k
views
Actual RSA encryption & decryption of strings?
$K_{pub} = (n, e)$
$K_{pvt} = d$
Then
$E_{K_{pub}}(x) \equiv x^e \mod n$
Practically, when RSA is used to encrypt strings, what is the $x$ here? You cannot take it byte by byte because $\mod n$ will ...
- 2,213
2
votes
2
answers
856
views
AES CBC: how shall i get to know with AES CBC method, the received Cipher Text is padded or not [closed]
Algorithm: AES - CBC mode with PKCS7 padding
KeyValue:
10a58869d74be5a374cf867cfb473859
IV:
...
- 253
2
votes
2
answers
1k
views
How does a Padding Oracle Attack work in practice?
I have understood how the padding oracle attack works in theory. Now, I am trying to visualize it in a real scenario.
Can someone please give a real scenario in which an attacker can insert himself ...
- 1,080
2
votes
1
answer
3k
views
How does OAEP improve the security of RSA?
The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$.
Does everybody (so also an adversary) know these functions?
If YES: How does it help the ...
- 171
2
votes
1
answer
384
views
Padding always the same, problem or not?
I need to transmit long encrypted messages to a smartcard over a limited capacity link so I need to fragment the messages somewhere before sending thzm.
My problem is that I split the message into 64-...
- 145
2
votes
2
answers
2k
views
Preferred SHA-2 hash algorithm for MGF1 in RSA
Does it make any difference to the security and efficiency if we use SHA-256 or SHA-512 for the Mask Generation Function MGF1 that generates the masking / padding within the OAEP encryption scheme and ...
- 92.6k
2
votes
1
answer
171
views
Why does bit padding work in practice in a message authentication code?
I understand that bit padding (add a 1, then 0's as needed) is a secure way to pad a message, preventing an unpadded message producing the same tag as a message that has been padded.
What I don't ...
- 21
2
votes
1
answer
654
views
Should I be concerned about padding oracle attacks if the lifespan of my key is ~1 minute?
I'm using 4096-bit RSA to encrypt a 256-bit AES key generated client-side. The RSA ciphertext is then sent to the server, and the server decrypts the RSA ciphertext to acquire the AES key. ...
- 562
2
votes
1
answer
23k
views
Removing Padded Value in Decrypted Message
How to remove padded value in Decrypted Message?
I am using AES Algorithm.
Let's take this as the decrypted message:
"abcdefghijklmn "
There is a 2 space in ...
- 1,727
2
votes
2
answers
2k
views
AES output lengths are not always a multiple of 16
I have a C# solution that encrypts a bunch of small data chunks using AES.
...
- 121
2
votes
1
answer
2k
views
What is the main problem with zero padding for AES key?
I am trying to understand the logic behind some basic principles of AES key padding. Why do we use different kinds of AES key padding schemes instead of the simplest zero-padding? Take AES-128 for ...
2
votes
1
answer
733
views
What is the padding block actually in merkle damgård?
I'm studying up on Merkle Damgård construction for hashing and having some trouble understanding the "padding block", at the end of the message blocks.
When you look it up it says that in ...
2
votes
2
answers
2k
views
Cannot understand Block Cipher example
I learned modern block cipher and saw this example.
How many padding bits must be added to a message of 100 characters if
8-bit ASCII is used for encoding and the block cipher accepts blocks
of 64 ...
- 153
2
votes
1
answer
205
views
OAEP Cryptanalysis
If $M_1$ and $M_2$ are $\operatorname{OAEP}$ padded, encrypted and sent and an adversary somehow manages to get around the encryption and retrieve $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(...
- 209
2
votes
2
answers
455
views
Clarification on the origin of `01` in this oracle padding attack?
I have found what I believe to be a straightforward explanation of the oracle padding attack here: http://robertheaton.com/2013/07/29/padding-oracle-attack/
I am however getting confused by something ...
- 1,080
2
votes
2
answers
193
views
Is it safe to use cipher block sizing instead of padding?
I'm using this kind of technique instead of padding of cipher buffer (here goes pseudo-code):
...
- 145