1

Is there any consensus (i.e. are there any research results) on the benefits and drawbacks of various padding schemes?

Generally there seem to be two kinds of them:

  • random paddings, like ISO10126 that pad with random data
  • fixed paddings, like PKCS5/7 and X.923 that pad with 0s or some fixed pattern

Is there any reason to prefer one over the other?

In another question of mine it was mentioned that random paddings may be susceptible to subliminal messages, but that answer doesn't cover paddings in general.

Community
  • 1
Dexter
  • 637
  • 1
  • 6
  • 10
  • Random paddings can be used as side channels, etc. But fixed paddings might be vulnerable to replay attacks. If something is deterministic, the attacker also knows all the relevant values. The impact of this depends on what scheme you are actually looking at. – tylo Sep 22 '14 at 11:17
  • 1
    Are you only talking about paddings used with symmetric block ciphers, as in your examples? Or also about paddings used for RSA/Rabin encryption? These kinds of paddings are quite different and should not be discussed in a single question. – CodesInChaos Sep 22 '14 at 11:31
  • @CodesInChaos I'm asking about symmetric block ciphers only. – Dexter Sep 22 '14 at 17:31

2 Answers2

2

In general we nowadays use fixed paddings or a stream mode of operation such as CTR.

Authentication tags are usually used to validate integrity/authenticity. Examples of authentication tags are those created by calculating a MAC or HMAC over the ciphertext and additional data such as the IV. In general known plaintext - including the padding - should not be used to validate integrity/authenticity.

Authenticated ciphers combine a mode of operation and authentication scheme using the same key. Many of them apply CTR mode encryption instead of a mode that requires (internal) padding.

If padding is required, then PKCS#7 padding should be preferred as it seems to be the ad-hoc standard within the defined standards. Basically you should not tie any security claims on the padding though (except possibly the one that subliminal channels are not possible in your particular protocol).

Maarten Bodewes
  • 92,551
  • 13
  • 161
  • 313
  • Only block cipher paddings were taken into account for above answer. – Maarten Bodewes Sep 22 '14 at 14:49
  • Yes, all of that is true, but it doesn't really answer the question. There may have been non-security-related reasons for the prevalence of PKCS#7. Or is PKCS#7 indeed somehow better than its alternatives? – Dexter Sep 22 '14 at 17:34
  • 1
    @Dexter It would be extremely tricky to find a definitive source for why PKCS#7 padding is prevalent. Note tat PKCS#7 defines CMS, and that CMS is a heavily used container format (just like PKCS#5 is still used for password based encryption). I could imagine somebody coming up with reasons why ISO/IEC 10126 is not used much. What I understood so far is that padding modes were quite heavily discussed up to the point that the crypto community gravitated to authentication tags... With an authentication tag, the padding scheme is not so interesting anymore, and newer protocols use CTR. – Maarten Bodewes Sep 22 '14 at 17:53
0

Fixed paddings are vulnerble to known plaintext attacks. If the attacker know that certain plaintext values are always the same then they could perform such an attack.

Random paddings do not lead to such an attack.

Uwe Plonus
  • 394
  • 3
  • 16
  • 2
    For symmetric encryption the IV introduces all the randomness you need. – CodesInChaos Sep 22 '14 at 11:20
  • @CodesInChaos I don't talk about randomness. If I pad a message with defined bytes then the attacker can try to decrypt the message and know that the decrypted text is right because of the padding... – Uwe Plonus Sep 22 '14 at 11:22
  • 7
    I don't understand what you want to say. 1) If you're talking about padding oracles (adaptive chosen ciphertext), the proper defense is a MAC. 2) If you're talking about semantic security and known/chosen plaintext attacks, it's the job of IVs/nonces to achieve that. 3) If you're talking about asymmetric encryption (RSA, Rabin) you need randomized padding, but RSA padding is conceptually very different from the block cipher paddings the OP mentioned. RSA padding includes properties which in the symmetric case are handled by MAC and IV instead of the padding. – CodesInChaos Sep 22 '14 at 11:29
  • Furthermore, paddings such as ISO10126 are only partially random, if I'm not mistaken. They don't fully avoid finding out information about the message if oracles apply. – Maarten Bodewes Sep 22 '14 at 14:10