SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Padding (cryptography)</title>

</head>

<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">Padding (cryptography)</span></span>

</h1>

</header>

/* start https://en.wikipedia.org/ */

.mw-parser-output .hatnote{font-style:italic}.mw-parser-output div.hatnote{padding-left:1.6em;margin-bottom:0.5em}.mw-parser-output .hatnote i{font-style:normal}.mw-parser-output .hatnote+link+.hatnote{margin-top:-0.5em}@media print{body.ns-0 .mw-parser-output .hatnote{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><div role="note" class="hatnote navigation-not-searchable">This article is about cryptography. For other uses of the term, see <a href="Padding_(disambiguation)" class="mw-disambig" title="Padding (disambiguation)">Padding (disambiguation)</a>.</div>

<p>In <a href="Cryptography" title="Cryptography">cryptography</a>, <b>padding</b> is any of a number of distinct practices which all include adding data to the beginning, middle, or end of a message prior to encryption. In classical cryptography, padding may include adding nonsense phrases to a message to obscure the fact that many messages end in predictable ways, e.g. <i>sincerely yours</i>.

</p>

<div class="mw-heading mw-heading2"><h2 id="Classical_cryptography">Classical cryptography</h2></div>

<p>Official messages often start and end in predictable ways: <i>My dear ambassador, Weather report, Sincerely yours</i>, etc. The primary use of padding with <a href="Classical_cipher" title="Classical cipher">classical ciphers</a> is to prevent the cryptanalyst from using that predictability to find <a href="Known-plaintext_attack" title="Known-plaintext attack">known plaintext</a><sup id="cite_ref-1" class="reference"><a href="#cite_note-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup> that aids in breaking the encryption. Random length padding also prevents an attacker from knowing the exact length of the plaintext message.

</p><p>A famous example of classical padding which caused a great misunderstanding is "<a href="The_world_wonders" title="The world wonders">the world wonders</a>" incident, which nearly caused an Allied loss at the World War II <a href="Battle_off_Samar" title="Battle off Samar">Battle off Samar</a>, part of the larger <a href="Battle_of_Leyte_Gulf" title="Battle of Leyte Gulf">Battle of Leyte Gulf</a>. In that example, <a href="Admiral_Chester_Nimitz" class="mw-redirect" title="Admiral Chester Nimitz">Admiral Chester Nimitz</a>, the <a href="CINCPACFLT" class="mw-redirect" title="CINCPACFLT">Commander in Chief, U.S. Pacific Fleet</a> in WWII, sent the following message to <a href="Admiral_Bull_Halsey" class="mw-redirect" title="Admiral Bull Halsey">Admiral Bull Halsey</a>, commander of Task Force Thirty Four (the main Allied fleet) at the Battle of Leyte Gulf, on October 25, 1944:<sup id="cite_ref-Willmott_2-0" class="reference"><a href="#cite_note-Willmott-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup>

</p>

/* start https://en.wikipedia.org/ */

.mw-parser-output .templatequote{overflow:hidden;margin:1em 0;padding:0 32px}.mw-parser-output .templatequotecite{line-height:1.5em;text-align:left;margin-top:0}@media(min-width:500px){.mw-parser-output .templatequotecite{padding-left:1.6em}}

/* end https://en.wikipedia.org/ */

</style><blockquote class="templatequote"><p>Where is, repeat, where is Task Force Thirty Four?<sup id="cite_ref-Tuohy_3-0" class="reference"><a href="#cite_note-Tuohy-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup></p></blockquote>

<p>With padding (bolded) and <a href="Metadata" title="Metadata">metadata</a> added, the message became:

</p>

<blockquote class="templatequote"><p><code><b>TURKEY TROTS TO WATER</b> GG FROM CINCPAC ACTION COM THIRD FLEET INFO COMINCH CTF SEVENTY-SEVEN X WHERE IS RPT WHERE IS TASK FORCE THIRTY FOUR RR <b>THE WORLD WONDERS</b></code><sup id="cite_ref-Tuohy_3-1" class="reference"><a href="#cite_note-Tuohy-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup></p></blockquote>

<p>Halsey's radio operator mistook some of the padding for the message and so Admiral Halsey ended up reading the following message:

</p>

<blockquote class="templatequote"><p>Where is, repeat, where is Task Force Thirty Four? The world wonders<sup id="cite_ref-Tuohy_3-2" class="reference"><a href="#cite_note-Tuohy-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup></p></blockquote>

<p>Admiral Halsey interpreted the padding phrase "the world wonders" as a sarcastic reprimand, which caused him to have an emotional outburst and then lock himself in his bridge and sulk for an hour before he moved his forces to assist at the Battle off Samar.<sup id="cite_ref-Willmott_2-1" class="reference"><a href="#cite_note-Willmott-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup> Halsey's radio operator should have been tipped off by the letters <i>RR</i> that "the world wonders" was padding; all other radio operators who received Admiral Nimitz's message correctly removed both padding phrases.<sup id="cite_ref-Willmott_2-2" class="reference"><a href="#cite_note-Willmott-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup>

</p><p>Many classical ciphers arrange the plaintext into particular patterns (e.g., squares, rectangles, etc.) and if the plaintext does not exactly fit, it is often necessary to supply additional letters to fill out the pattern. Using nonsense letters for this purpose has a side benefit of making some kinds of cryptanalysis more difficult.

</p>

<div class="mw-heading mw-heading2"><h2 id="Symmetric_cryptography">Symmetric cryptography</h2></div>

<div class="mw-heading mw-heading3"><h3 id="Hash_functions">Hash functions</h3></div>

<p>Most modern <a href="Cryptographic_hash_function" title="Cryptographic hash function">cryptographic hash functions</a> process messages in fixed-length blocks; all but the earliest hash functions include some sort of padding scheme. It is critical for cryptographic hash functions to employ termination schemes that prevent a hash from being vulnerable to <a href="Length_extension_attack" title="Length extension attack">length extension attacks</a>.

</p><p>Many padding schemes are based on appending predictable data to the final block. For example, the pad could be derived from the total length of the message. This kind of padding scheme is commonly applied to hash algorithms that use the <a href="Merkle%E2%80%93Damg%C3%A5rd_construction" title="Merkle–Damgård construction">Merkle–Damgård construction</a> such as <a href="MD5" title="MD5">MD-5</a>, <a href="SHA-1" title="SHA-1">SHA-1</a>, and <a href="SHA-2" title="SHA-2">SHA-2 family</a> such as SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256<sup id="cite_ref-FIPS_180-4_4-0" class="reference"><a href="#cite_note-FIPS_180-4-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading3"><h3 id="Block_cipher_mode_of_operation">Block cipher mode of operation</h3></div>

<p><a href="Block_cipher_modes_of_operation" class="mw-redirect" title="Block cipher modes of operation">Cipher-block chaining</a> (CBC) mode is an example of <a href="Block_cipher_mode_of_operation" title="Block cipher mode of operation">block cipher mode of operation</a>. Some block cipher modes (CBC and PCBC essentially) for <a href="Symmetric-key_encryption_algorithm" class="mw-redirect" title="Symmetric-key encryption algorithm">symmetric-key encryption algorithms</a> require plain text input that is a multiple of the block size, so messages may have to be padded to bring them to this length.

</p>

/* start https://en.wikipedia.org/ */

.mw-parser-output .ambox{border:1px solid #a2a9b1;border-left:10px solid #36c;background-color:#fbfbfb;box-sizing:border-box}.mw-parser-output .ambox+link+.ambox,.mw-parser-output .ambox+link+style+.ambox,.mw-parser-output .ambox+link+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+style+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+link+.ambox{margin-top:-1px}html body.mediawiki .mw-parser-output .ambox.mbox-small-left{margin:4px 1em 4px 0;overflow:hidden;width:238px;border-collapse:collapse;font-size:88%;line-height:1.25em}.mw-parser-output .ambox-speedy{border-left:10px solid #b32424;background-color:#fee7e6}.mw-parser-output .ambox-delete{border-left:10px solid #b32424}.mw-parser-output .ambox-content{border-left:10px solid #f28500}.mw-parser-output .ambox-style{border-left:10px solid #fc3}.mw-parser-output .ambox-move{border-left:10px solid #9932cc}.mw-parser-output .ambox-protection{border-left:10px solid #a2a9b1}.mw-parser-output .ambox .mbox-text{border:none;padding:0.25em 0.5em;width:100%}.mw-parser-output .ambox .mbox-image{border:none;padding:2px 0 2px 0.5em;text-align:center}.mw-parser-output .ambox .mbox-imageright{border:none;padding:2px 0.5em 2px 0;text-align:center}.mw-parser-output .ambox .mbox-empty-cell{border:none;padding:0;width:1px}.mw-parser-output .ambox .mbox-image-div{width:52px}@media(min-width:720px){.mw-parser-output .ambox{margin:0 10%}}@media print{body.ns-0 .mw-parser-output .ambox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style>

<p>There is currently a shift to use streaming mode of operation instead of block mode of operation. An example of streaming mode encryption is the <a href="Block_cipher_modes_of_operation" class="mw-redirect" title="Block cipher modes of operation">counter mode of operation</a>.<sup id="cite_ref-5" class="reference"><a href="#cite_note-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup> Streaming modes of operation can encrypt and decrypt messages of any size and therefore do not require padding. More intricate ways of ending a message such as <a href="Ciphertext_stealing" title="Ciphertext stealing">ciphertext stealing</a> or <a href="Residual_block_termination" title="Residual block termination">residual block termination</a> avoid the need for padding.

</p><p>A disadvantage of padding is that it makes the plain text of the message susceptible to <a href="Padding_oracle_attack" title="Padding oracle attack">padding oracle attacks</a>. Padding oracle attacks allow the attacker to gain knowledge of the plain text without attacking the block cipher primitive itself. Padding oracle attacks can be avoided by making sure that an attacker cannot gain knowledge about the removal of the padding bytes. This can be accomplished by verifying a <a href="Message_authentication_code" title="Message authentication code">message authentication code (MAC)</a> or <a href="Digital_signature" title="Digital signature">digital signature</a> <i>before</i> removal of the padding bytes, or by switching to a streaming mode of operation.

</p>

<div class="mw-heading mw-heading4"><h4 id="Bit_padding">Bit padding</h4></div>

<p>Bit padding can be applied to messages of any size.

</p><p>A single '1' bit is added to the message and then as many '0' bits as required (possibly none) are added. The number of '0' bits added will depend on the block boundary to which the message needs to be extended. In bit terms this is "1000 ... 0000".

</p><p>This method can be used to pad messages which are any number of bits long, not necessarily a whole number of bytes long. For example, a message of 23 bits that is padded with 9 bits in order to fill a 32-bit block:

</p>

<pre>... | 1011 1001 1101 0100 0010 011<b>1 0000 0000</b> |

</pre>

<p>This padding is the first step of a two-step padding scheme used in many <a href="Hash_functions" class="mw-redirect" title="Hash functions">hash functions</a> including <a href="MD5" title="MD5">MD5</a> and <a href="Secure_Hash_Algorithm_(disambiguation)" class="mw-redirect" title="Secure Hash Algorithm (disambiguation)">SHA</a>. In this context, it is specified by <a rel="nofollow" class="external text" href="http://www.faqs.org/rfcs/rfc1321.html">RFC1321</a> step 3.1.

</p><p>This padding scheme is defined by <a href="ISO/IEC_9797-1" title="ISO/IEC 9797-1">ISO/IEC 9797-1</a> as Padding Method 2.

</p>

<div class="mw-heading mw-heading4"><h4 id="Byte_padding">Byte padding</h4></div>

<p>Byte padding can be applied to messages that can be encoded as an integral number of <a href="Byte" title="Byte">bytes</a>.

</p>

<p>In ANSI X9.23, between 1 and 8 bytes are always added as padding. The block is padded with random bytes (although many implementations use 00) and the last byte of the block is set to the number of bytes added.<sup id="cite_ref-6" class="reference"><a href="#cite_note-6"><span class="cite-bracket">[</span>6<span class="cite-bracket">]</span></a></sup>

</p><p>Example:

In the following example the block size is 8 bytes, and padding is required for 4 bytes (in hexadecimal format)

</p>

<pre>... | DD DD DD DD DD DD DD DD | DD DD DD DD <b>00 00 00 04</b> |

</pre>

<p>ISO 10126 (withdrawn in 2007<sup id="cite_ref-7" class="reference"><a href="#cite_note-7"><span class="cite-bracket">[</span>7<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-8" class="reference"><a href="#cite_note-8"><span class="cite-bracket">[</span>8<span class="cite-bracket">]</span></a></sup>) specifies that the padding should be done at the end of that last block with random bytes, and the padding boundary should be specified by the last byte.

</p><p>Example:

In the following example the block size is 8 bytes and padding is required for 4 bytes

</p>

<pre>... | DD DD DD DD DD DD DD DD | DD DD DD DD <b>81 A6 23 04</b> |

</pre>

<p><a href="PKCS" title="PKCS">PKCS#7</a> is described in <a rel="nofollow" class="external text" href="https://tools.ietf.org/html/rfc5652#section-6.3">RFC 5652</a>.

</p><p>Padding is in whole bytes. The value of each added byte is the number of bytes that are added, i.e. <var style="padding-right: 1px;">N</var> bytes, each of value <var style="padding-right: 1px;">N</var> are added. The number of bytes added will depend on the block boundary to which the message needs to be extended.

</p><p>The padding will be one of:

</p>

<pre>01

02 02

03 03 03

04 04 04 04

05 05 05 05 05

06 06 06 06 06 06

etc.

</pre>

<p>This padding method (as well as the previous two) is well-defined if and only if <var style="padding-right: 1px;">N</var> is less than 256.

</p><p>Example:

In the following example, the block size is 8 bytes and padding is required for 4 bytes

</p>

<pre>... | DD DD DD DD DD DD DD DD | DD DD DD DD <b>04 04 04 04</b> |

</pre>

<p>If the length of the original data is an integer multiple of the block size <var style="padding-right: 1px;">B</var>, then an extra block of bytes with value <var style="padding-right: 1px;">B</var> is added. This is necessary so the deciphering algorithm can determine with certainty whether the last byte of the last block is a pad byte indicating the number of padding bytes added or part of the plaintext message. Consider a plaintext message that is an integer multiple of <var style="padding-right: 1px;">B</var> bytes with the last byte of plaintext being <b>01</b>. With no additional information, the deciphering algorithm will not be able to determine whether the last byte is a plaintext byte or a pad byte. However, by adding <var style="padding-right: 1px;">B</var> bytes each of value <var style="padding-right: 1px;">B</var> after the <b>01</b> plaintext byte, the deciphering algorithm can always treat the last byte as a pad byte and strip the appropriate number of pad bytes off the end of the ciphertext; said number of bytes to be stripped based on the value of the last byte.

</p><p>PKCS#5 padding is identical to PKCS#7 padding, except that it has only been defined for block ciphers that use a 64-bit (8-byte) block size. In practice, the two can be used interchangeably.

</p><p>The maximum block size is 255, as it is the biggest number a byte can contain.

</p>

<p><a href="ISO/IEC_7816" title="ISO/IEC 7816">ISO/IEC 7816</a>-4:2005<sup id="cite_ref-9" class="reference"><a href="#cite_note-9"><span class="cite-bracket">[</span>9<span class="cite-bracket">]</span></a></sup> is identical to the bit padding scheme, applied to a plain text of <i>N</i> bytes. This means in practice that the first byte is a mandatory byte valued '80' (Hexadecimal) followed, if needed, by 0 to <i>N</i> − 1 bytes set to '00', until the end of the block is reached. ISO/IEC 7816-4 itself is a communication standard for smart cards containing a file system, and in itself does not contain any cryptographic specifications.

</p><p>Example:

In the following example the block size is 8 bytes and padding is required for 4 bytes

</p>

<pre>... | DD DD DD DD DD DD DD DD | DD DD DD DD <b>80 00 00 00</b> |

</pre>

<p>The next example shows a padding of just one byte

</p>

<pre>... | DD DD DD DD DD DD DD DD | DD DD DD DD DD DD DD <b>80</b> |

</pre>

<div class="mw-heading mw-heading5"><h5 id="Zero_padding">Zero padding</h5></div>

<p>All the bytes that are required to be padded are padded with zero. The zero padding scheme has not been standardized for encryption, although it is specified for hashes and MACs as Padding Method 1 in ISO/IEC 10118-1<sup id="cite_ref-10" class="reference"><a href="#cite_note-10"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup> and <a href="ISO/IEC_9797-1" title="ISO/IEC 9797-1">ISO/IEC 9797-1</a>.<sup id="cite_ref-11" class="reference"><a href="#cite_note-11"><span class="cite-bracket">[</span>11<span class="cite-bracket">]</span></a></sup>

</p><p>Example:

In the following example the block size is 8 bytes and padding is required for 4 bytes

</p>

<pre>... | DD DD DD DD DD DD DD DD | DD DD DD DD <b>00 00 00 00</b> |

</pre>

<p>Zero padding may not be reversible if the original file ends with one or more zero bytes, making it impossible to distinguish between plaintext data bytes and padding bytes. It may be used when the length of the message can be derived <a href="Out-of-band_data" title="Out-of-band data">out-of-band</a>. It is often applied to binary encoded <a href="String_(computer_science)" title="String (computer science)">strings</a> (<a href="Null-terminated_string" title="Null-terminated string">null-terminated string</a>) as the <a href="Null_character" title="Null character">null character</a> can usually be stripped off as <a href="Whitespace_character" title="Whitespace character">whitespace</a>.

</p><p>Zero padding is sometimes also referred to as "null padding" or "zero byte padding". Some implementations may add an additional block of zero bytes if the plaintext is already divisible by the block size.

</p>

<div class="mw-heading mw-heading2"><h2 id="Public_key_cryptography">Public key cryptography</h2></div>

<p>In <a href="Public_key_cryptography" class="mw-redirect" title="Public key cryptography">public key cryptography</a>, padding is the process of preparing a message for encryption or signing using a specification or scheme such as <a href="PKCS1" class="mw-redirect" title="PKCS1">PKCS#1</a> v2.2, <a href="OAEP" class="mw-redirect" title="OAEP">OAEP</a>, <a href="Probabilistic_signature_scheme" title="Probabilistic signature scheme">PSS</a>, PSSR, IEEE P1363 EMSA2 and EMSA5. A modern form of padding for asymmetric primitives is <a href="Optimal_Asymmetric_Encryption_Padding" class="mw-redirect" title="Optimal Asymmetric Encryption Padding">OAEP</a> applied to the <a href="RSA_(algorithm)" class="mw-redirect" title="RSA (algorithm)">RSA algorithm</a>, when it is used to encrypt a limited number of bytes.

</p><p>The operation is referred to as "padding" because originally, random material was simply appended to the message to make it long enough for the primitive. This form of padding is not secure and is therefore no longer applied. A modern padding scheme aims to ensure that the attacker cannot manipulate the plaintext to exploit the mathematical structure of the primitive and will usually be accompanied by a proof, often in the <a href="Random_oracle_model" class="mw-redirect" title="Random oracle model">random oracle model</a>, that breaking the padding scheme is as hard as solving the hard problem underlying the primitive.

</p>

<div class="mw-heading mw-heading2"><h2 id="Traffic_analysis_and_protection_via_padding">Traffic analysis and protection via padding</h2></div>

<p>Even if perfect cryptographic routines are used, the attacker can gain knowledge of the amount of traffic that was generated. The attacker might not know what <a href="Alice_and_Bob" title="Alice and Bob">Alice and Bob</a> were talking about, but can know that they <i>were</i> talking and <i>how much</i> they talked. In some circumstances this leakage can be highly compromising. Consider for example when a military is organising a secret attack against another nation: it may suffice to alert the other nation for them to know merely that there <i>is</i> a lot of secret activity going on.

</p><p>As another example, when encrypting <a href="VOIP" class="mw-redirect" title="VOIP">Voice Over IP</a> streams that use variable bit rate encoding, the number of bits per unit of time is not obscured, and this can be exploited to guess spoken phrases.<sup id="cite_ref-12" class="reference"><a href="#cite_note-12"><span class="cite-bracket">[</span>12<span class="cite-bracket">]</span></a></sup> Similarly, the burst patterns that common video encoders produce are often sufficient to identify the streaming video a user is watching uniquely.<sup id="cite_ref-13" class="reference"><a href="#cite_note-13"><span class="cite-bracket">[</span>13<span class="cite-bracket">]</span></a></sup> Even the <i>total size</i> of an object alone, such as a website, file, software package download, or online video, can uniquely identify an object, if the attacker knows or can guess a known set the object comes from.<sup id="cite_ref-14" class="reference"><a href="#cite_note-14"><span class="cite-bracket">[</span>14<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-15" class="reference"><a href="#cite_note-15"><span class="cite-bracket">[</span>15<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-pets19_16-0" class="reference"><a href="#cite_note-pets19-16"><span class="cite-bracket">[</span>16<span class="cite-bracket">]</span></a></sup> The <a href="Side-channel_attack" title="Side-channel attack">side-channel</a> of encrypted content length was used to extract passwords from <a href="HTTPS" title="HTTPS">HTTPS</a> communications in the well-known <a href="CRIME" title="CRIME">CRIME</a> and <a href="BREACH" title="BREACH">BREACH</a> attacks.<sup id="cite_ref-17" class="reference"><a href="#cite_note-17"><span class="cite-bracket">[</span>17<span class="cite-bracket">]</span></a></sup>

</p><p>Padding an encrypted message can make <a href="Traffic_analysis" title="Traffic analysis">traffic analysis</a> harder by obscuring the true length of its payload. The choice of length to pad a message to may be made either deterministically or randomly; each approach has strengths and weaknesses that apply in different contexts.

</p>

<div class="mw-heading mw-heading3"><h3 id="Randomized_padding">Randomized padding</h3></div>

<p>A random number of additional padding bits or bytes may be appended to the end of a message, together with an indication at the end how much padding was added. If the amount of padding is chosen as a uniform random number between 0 and some maximum M, for example, then an eavesdropper will be unable to determine the message's length precisely within that range. If the maximum padding M is small compared to the message's total size, then this padding will not add much <a href="Overhead_(computing)" title="Overhead (computing)">overhead</a>, but the padding will obscure only the least-significant bits of the object's total length, leaving the approximate length of large objects readily observable and hence still potentially uniquely identifiable by their length. If the maximum padding M is comparable to the size of the payload, in contrast, an eavesdropper's uncertainty about the message's true payload size is much larger, at the cost that padding may add up to 100% overhead (<span class="texhtml">2×</span> blow-up) to the message.

</p><p>In addition, in common scenarios in which an eavesdropper has the opportunity to see <i>many</i> successive messages from the same sender, and those messages are similar in ways the attacker knows or can guess, then the eavesdropper can use statistical techniques to decrease and eventually even eliminate the benefit of randomized padding. For example, suppose a user's application regularly sends messages of the same length, and the eavesdropper knows or can guess fact based on fingerprinting the user's application for example. Alternatively, an active attacker might be able to <i>induce</i> an endpoint to send messages regularly, such as if the victim is a public server. In such cases, the eavesdropper can simply compute the average over many observations to determine the length of the regular message's payload.

</p>

<div class="mw-heading mw-heading3"><h3 id="Deterministic_padding">Deterministic padding</h3></div>

<p>A deterministic padding scheme always pads a message payload of a given length to form an encrypted message of a particular corresponding output length. When many payload lengths map to the same padded output length, an eavesdropper cannot distinguish or learn any information about the payload's true length within one of these length <i>buckets</i>, even after many observations of the identical-length messages being transmitted. In this respect, deterministic padding schemes have the advantage of not leaking any additional information with each successive message of the same payload size.

</p><p>On the other hand, suppose an eavesdropper can benefit from learning about <i>small</i> variations in payload size, such as plus or minus just one byte in a password-guessing attack for example. If the message sender is unlucky enough to send many messages whose payload lengths vary by only one byte, and that length is exactly on the border between two of the deterministic padding classes, then these plus-or-minus one payload lengths will consistently yield different padded lengths as well (plus-or-minus one block for example), leaking exactly the fine-grained information the attacker desires. Against such risks, randomized padding can offer more protection by independently obscuring the least-significant bits of message lengths.

</p><p>Common deterministic padding methods include padding to a constant block size and padding to the next-larger power of two. Like randomized padding with a small maximum amount <i>M</i>, however, padding deterministically to a block size much smaller than the message payload obscures only the least-significant bits of the messages true length, leaving the messages's true approximate length largely unprotected. Padding messages to a power of two (or any other fixed base) reduces the maximum amount of <a href="Entropy_(information_theory)" title="Entropy (information theory)">information</a> that the message can leak via its length from <span class="texhtml"><i>O</i>(log <i>M</i>)</span> to <span class="texhtml"><i>O</i>(log log <i>M</i>)</span>. Padding to a power of two increases message size overhead by up to 100%, however, and padding to powers of larger integer bases increase maximum overhead further.

</p><p>The PADMÉ scheme, proposed for <a href="PURB_(cryptography)" title="PURB (cryptography)">padded uniform random blobs or PURBs</a>, deterministically pads messages to lengths representable as a <a href="IEEE_754" title="IEEE 754">floating point number</a> whose mantissa is no longer (i.e., contains no more significant bits) than its exponent.<sup id="cite_ref-pets19_16-1" class="reference"><a href="#cite_note-pets19-16"><span class="cite-bracket">[</span>16<span class="cite-bracket">]</span></a></sup> This length constraint ensures that a message leaks at most <span class="texhtml"><i>O</i>(log log <i>M</i>)</span> bits of information via its length, like padding to a power of two, but incurs much less overhead of at most 12% for tiny messages and decreasing gradually with message size.

</p>

<ul><li><a href="Chaffing_and_winnowing" title="Chaffing and winnowing">Chaffing and winnowing</a>, mixing in large amounts of nonsense before sending</li>

<li><a href="Ciphertext_stealing" title="Ciphertext stealing">Ciphertext stealing</a>, another approach to deal with messages that are not a multiple of the block length</li>

<li><a href="Initialization_vector" title="Initialization vector">Initialization vector</a>, <a href="Salt_(cryptography)" title="Salt (cryptography)">salt (cryptography)</a>, which are sometimes confused with padding</li>

<li><a href="Key_encapsulation" class="mw-redirect" title="Key encapsulation">Key encapsulation</a>, an alternative to padding for public key systems used to exchange symmetric keys</li>

<li><a href="PURB_(cryptography)" title="PURB (cryptography)">PURB</a> or <i>padded uniform random blob</i>, an encryption discipline that minimizes leakage from either metadata or length</li>

<li><a href="Russian_copulation" title="Russian copulation">Russian copulation</a>, another technique to prevent cribs</li></ul>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist reflist-columns references-column-width" style="column-width: 30em;">

<li id="cite_note-1"><span class="mw-cite-backlink"><b><a href="#cite_ref-1">^</a></b></span> <span class="reference-text"><a href="Gordon_Welchman" title="Gordon Welchman">Gordon Welchman</a>, <i>The Hut Six Story: Breaking the Enigma Codes</i>, p. 78.</span>

</li>

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite id="CITEREFWillmott2005" class="citation book cs1">Willmott, H. P. (19 August 2005). "The Great Day of Wrath: 25 October 1944". <i>The Battle of Leyte Gulf: The Last Fleet Action</i>. Indiana University Press. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>9780253003515</bdi>.</cite></span>

</li>

<li id="cite_note-Tuohy-3"><span class="mw-cite-backlink">^ <a href="#cite_ref-Tuohy_3-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-Tuohy_3-1"><sup><i><b>b</b></i></sup></a> <a href="#cite_ref-Tuohy_3-2"><sup><i><b>c</b></i></sup></a></span> <span class="reference-text"><cite id="CITEREFTuohy2007" class="citation book cs1">Tuohy, William (2007). <span class="id-lock-registration" title="Free registration required"><a rel="nofollow" class="external text" href="https://archive.org/details/americasfighting00tuoh"><i>America's Fighting Admirals: Winning the War at Sea in World War II</i></a></span>. MBI Publishing Company. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>9780760329856</bdi>.</cite></span>

</li>

<li id="cite_note-FIPS_180-4-4"><span class="mw-cite-backlink"><b><a href="#cite_ref-FIPS_180-4_4-0">^</a></b></span> <span class="reference-text"><cite id="CITEREFNIST" class="citation web cs1">NIST. <a rel="nofollow" class="external text" href="https://csrc.nist.gov/csrc/media/publications/fips/180/4/final/documents/fips180-4-draft-aug2014.pdf">"FIPS 180-4 Secure Hash Standard (SHS)"</a> <span class="cs1-format">(PDF)</span>. NIST.</cite>.</span>

</li>

<li id="cite_note-5"><span class="mw-cite-backlink"><b><a href="#cite_ref-5">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external free" href="https://www.cs.columbia.edu/~smb/classes/s09/l05.pdf">https://www.cs.columbia.edu/~smb/classes/s09/l05.pdf</a>, pg 17</span>

</li>

<li id="cite_note-6"><span class="mw-cite-backlink"><b><a href="#cite_ref-6">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.ibm.com/support/knowledgecenter/en/linuxonibm/com.ibm.linux.z.wskc.doc/wskc_c_l0wskc58.html">"ANSI X9.23 cipher block chaining"</a>. <i>IBM Knowledge Center</i>. IBM<span class="reference-accessdate">. Retrieved <span class="nowrap">31 December</span> 2018</span>.</cite></span>

</li>

<li id="cite_note-7"><span class="mw-cite-backlink"><b><a href="#cite_ref-7">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=18113">ISO catalog, <i>ISO 10126-1:1991</i></a></span>

</li>

<li id="cite_note-8"><span class="mw-cite-backlink"><b><a href="#cite_ref-8">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=18114">ISO catalog, <i>ISO 10126-2:1991</i></a></span>

</li>

<li id="cite_note-9"><span class="mw-cite-backlink"><b><a href="#cite_ref-9">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="http://www.iso.org/iso/home/store/catalogue_tc/catalogue_detail.htm?csnumber=36134">ISO catalog, <i>ISO/IEC 7816-4:2005</i></a></span>

</li>

<li id="cite_note-10"><span class="mw-cite-backlink"><b><a href="#cite_ref-10">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="https://www.iso.org/standard/64213.html">ISO/IEC 10118-1:2016 <i>Information technology – Security techniques – Hash-functions – Part 1: General</i></a></span>

</li>

<li id="cite_note-11"><span class="mw-cite-backlink"><b><a href="#cite_ref-11">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="https://www.iso.org/standard/50375.html">ISO/IEC 9797-1:2011 <i>Information technology – Security techniques – Message Authentication Codes (MACs) – Part 1: Mechanisms using a block cipher</i></a></span>

</li>

<li id="cite_note-12"><span class="mw-cite-backlink"><b><a href="#cite_ref-12">^</a></b></span> <span class="reference-text"><cite id="CITEREFWrightBallardCoullMonrose2010" class="citation journal cs1">Wright, Charles V.; Ballard, Lucas; Coull, Scott E.; Monrose, Fabian; Masson, Gerald M. (1 December 2010). "Uncovering Spoken Phrases in Encrypted Voice over IP Conversations". <i>ACM Transactions on Information and System Security</i>. <b>13</b> (4): 35. <a href="CiteSeerX_(identifier)" class="mw-redirect" title="CiteSeerX (identifier)">CiteSeerX</a> <span class="id-lock-free" title="Freely accessible"><a rel="nofollow" class="external text" href="https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.363.1973">10.1.1.363.1973</a></span>. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F1880022.1880029">10.1145/1880022.1880029</a>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:9622722">9622722</a>.</cite></span>

</li>

<li id="cite_note-13"><span class="mw-cite-backlink"><b><a href="#cite_ref-13">^</a></b></span> <span class="reference-text"><cite id="CITEREFSchusterShmatikovTromer2017" class="citation conference cs1">Schuster, Roei; Shmatikov, Vitaly; Tromer, Eran (August 2017). <a rel="nofollow" class="external text" href="https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/schuster"><i>Beauty and the Burst: Remote Identification of Encrypted Video Streams</i></a>. <a rel="nofollow" class="external text" href="https://www.usenix.org/conference/usenixsecurity17">USENIX Security Symposium</a>.</cite></span>

</li>

<li id="cite_note-14"><span class="mw-cite-backlink"><b><a href="#cite_ref-14">^</a></b></span> <span class="reference-text"><cite id="CITEREFHintz2002" class="citation conference cs1">Hintz, Andrew (April 2002). "Fingerprinting Websites Using Traffic Analysis". <i>Privacy Enhancing Technologies</i>. International Workshop on Privacy Enhancing Technologies. Lecture Notes in Computer Science. Vol. 2482. pp. <span class="nowrap">171–</span>178. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1007%2F3-540-36467-6_13">10.1007/3-540-36467-6_13</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-3-540-00565-0</bdi>.</cite></span>

</li>

<li id="cite_note-15"><span class="mw-cite-backlink"><b><a href="#cite_ref-15">^</a></b></span> <span class="reference-text"><cite id="CITEREFSunSimonWangRussell2002" class="citation conference cs1">Sun, Qixiang; Simon, D.R.; Wang, Yi-Min; Russell, W.; Padmanabhan, V.N.; Qiu, Lili (May 2002). "Statistical Identification of Encrypted Web Browsing Traffic". <i>Proceedings 2002 IEEE Symposium on Security and Privacy</i>. IEEE Symposium on Security and Privacy. pp. <span class="nowrap">19–</span>30. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1109%2FSECPRI.2002.1004359">10.1109/SECPRI.2002.1004359</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>0-7695-1543-6</bdi>.</cite></span>

</li>

<li id="cite_note-pets19-16"><span class="mw-cite-backlink">^ <a href="#cite_ref-pets19_16-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-pets19_16-1"><sup><i><b>b</b></i></sup></a></span> <span class="reference-text"><cite id="CITEREFNikitinBarmanLueksUnderwood2019" class="citation journal cs1">Nikitin, Kirill; Barman, Ludovic; Lueks, Wouter; Underwood, Matthew; Hubaux, Jean-Pierre; Ford, Bryan (2019). <a rel="nofollow" class="external text" href="https://petsymposium.org/2019/files/papers/issue4/popets-2019-0056.pdf">"Reducing Metadata Leakage from Encrypted Files and Communication with PURBs"</a> <span class="cs1-format">(PDF)</span>. <i>Proceedings on Privacy Enhancing Technologies (PoPETS)</i>. <b>2019</b> (4): <span class="nowrap">6–</span>33. <a href="ArXiv_(identifier)" class="mw-redirect" title="ArXiv (identifier)">arXiv</a>:<span class="id-lock-free" title="Freely accessible"><a rel="nofollow" class="external text" href="https://arxiv.org/abs/1806.03160">1806.03160</a></span>. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<span class="id-lock-free" title="Freely accessible"><a rel="nofollow" class="external text" href="https://doi.org/10.2478%2Fpopets-2019-0056">10.2478/popets-2019-0056</a></span>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:47011059">47011059</a>.</cite></span>

</li>

<li id="cite_note-17"><span class="mw-cite-backlink"><b><a href="#cite_ref-17">^</a></b></span> <span class="reference-text"><cite id="CITEREFShefferHolzSaint-Andre2015" class="citation report cs1">Sheffer, Y.; Holz, R.; Saint-Andre, P. (February 2015). <a rel="nofollow" class="external text" href="https://tools.ietf.org/html/rfc7457">Summarizing Known Attacks on Transport Layer Security (TLS) and Datagram TLS (DTLS)</a> (Report).</cite></span>

</li>

</ol></div>

<div class="mw-heading mw-heading2"><h2 id="Further_reading">Further reading</h2></div>

<ul><li>XCBC: <a rel="nofollow" class="external text" href="http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/workshop2/presentations/xcbc.pdf">csrc.nist.gov/groups/ST/toolkit/BCM/documents/workshop2/presentations/xcbc.pdf</a></li></ul>

/* start https://en.wikipedia.org/ */

.mw-parser-output .hlist dl,.mw-parser-output .hlist ol,.mw-parser-output .hlist ul{margin:0;padding:0}.mw-parser-output .hlist dd,.mw-parser-output .hlist dt,.mw-parser-output .hlist li{margin:0;display:inline}.mw-parser-output .hlist.inline,.mw-parser-output .hlist.inline dl,.mw-parser-output .hlist.inline ol,.mw-parser-output .hlist.inline ul,.mw-parser-output .hlist dl dl,.mw-parser-output .hlist dl ol,.mw-parser-output .hlist dl ul,.mw-parser-output .hlist ol dl,.mw-parser-output .hlist ol ol,.mw-parser-output .hlist ol ul,.mw-parser-output .hlist ul dl,.mw-parser-output .hlist ul ol,.mw-parser-output .hlist ul ul{display:inline}.mw-parser-output .hlist .mw-empty-li{display:none}.mw-parser-output .hlist dt::after{content:": "}.mw-parser-output .hlist dd::after,.mw-parser-output .hlist li::after{content:" · ";font-weight:bold}.mw-parser-output .hlist dd:last-child::after,.mw-parser-output .hlist dt:last-child::after,.mw-parser-output .hlist li:last-child::after{content:none}.mw-parser-output .hlist dd dd:first-child::before,.mw-parser-output .hlist dd dt:first-child::before,.mw-parser-output .hlist dd li:first-child::before,.mw-parser-output .hlist dt dd:first-child::before,.mw-parser-output .hlist dt dt:first-child::before,.mw-parser-output .hlist dt li:first-child::before,.mw-parser-output .hlist li dd:first-child::before,.mw-parser-output .hlist li dt:first-child::before,.mw-parser-output .hlist li li:first-child::before{content:" (";font-weight:normal}.mw-parser-output .hlist dd dd:last-child::after,.mw-parser-output .hlist dd dt:last-child::after,.mw-parser-output .hlist dd li:last-child::after,.mw-parser-output .hlist dt dd:last-child::after,.mw-parser-output .hlist dt dt:last-child::after,.mw-parser-output .hlist dt li:last-child::after,.mw-parser-output .hlist li dd:last-child::after,.mw-parser-output .hlist li dt:last-child::after,.mw-parser-output .hlist li li:last-child::after{content:")";font-weight:normal}.mw-parser-output .hlist ol{counter-reset:listitem}.mw-parser-output .hlist ol>li{counter-increment:listitem}.mw-parser-output .hlist ol>li::before{content:" "counter(listitem)"\a0 "}.mw-parser-output .hlist dd ol>li:first-child::before,.mw-parser-output .hlist dt ol>li:first-child::before,.mw-parser-output .hlist li ol>li:first-child::before{content:" ("counter(listitem)"\a0 "}

/* end https://en.wikipedia.org/ */

</style><style data-mw-deduplicate="TemplateStyles:r1236075235">

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbox{box-sizing:border-box;border:1px solid #a2a9b1;width:100%;clear:both;font-size:88%;text-align:center;padding:1px;margin:1em auto 0}.mw-parser-output .navbox .navbox{margin-top:0}.mw-parser-output .navbox+.navbox,.mw-parser-output .navbox+.navbox-styles+.navbox{margin-top:-1px}.mw-parser-output .navbox-inner,.mw-parser-output .navbox-subgroup{width:100%}.mw-parser-output .navbox-group,.mw-parser-output .navbox-title,.mw-parser-output .navbox-abovebelow{padding:0.25em 1em;line-height:1.5em;text-align:center}.mw-parser-output .navbox-group{white-space:nowrap;text-align:right}.mw-parser-output .navbox,.mw-parser-output .navbox-subgroup{background-color:#fdfdfd}.mw-parser-output .navbox-list{line-height:1.5em;border-color:#fdfdfd}.mw-parser-output .navbox-list-with-group{text-align:left;border-left-width:2px;border-left-style:solid}.mw-parser-output tr+tr>.navbox-abovebelow,.mw-parser-output tr+tr>.navbox-group,.mw-parser-output tr+tr>.navbox-image,.mw-parser-output tr+tr>.navbox-list{border-top:2px solid #fdfdfd}.mw-parser-output .navbox-title{background-color:#ccf}.mw-parser-output .navbox-abovebelow,.mw-parser-output .navbox-group,.mw-parser-output .navbox-subgroup .navbox-title{background-color:#ddf}.mw-parser-output .navbox-subgroup .navbox-group,.mw-parser-output .navbox-subgroup .navbox-abovebelow{background-color:#e6e6ff}.mw-parser-output .navbox-even{background-color:#f7f7f7}.mw-parser-output .navbox-odd{background-color:transparent}.mw-parser-output .navbox .hlist td dl,.mw-parser-output .navbox .hlist td ol,.mw-parser-output .navbox .hlist td ul,.mw-parser-output .navbox td.hlist dl,.mw-parser-output .navbox td.hlist ol,.mw-parser-output .navbox td.hlist ul{padding:0.125em 0}.mw-parser-output .navbox .navbar{display:block;font-size:100%}.mw-parser-output .navbox-title .navbar{float:left;text-align:left;margin-right:0.5em}body.skin--responsive .mw-parser-output .navbox-image img{max-width:none!important}@media print{body.ns-0 .mw-parser-output .navbox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><style data-mw-deduplicate="TemplateStyles:r1239400231">

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbar{display:inline;font-size:88%;font-weight:normal}.mw-parser-output .navbar-collapse{float:left;text-align:left}.mw-parser-output .navbar-boxtext{word-spacing:0}.mw-parser-output .navbar ul{display:inline-block;white-space:nowrap;line-height:inherit}.mw-parser-output .navbar-brackets::before{margin-right:-0.125em;content:"[ "}.mw-parser-output .navbar-brackets::after{margin-left:-0.125em;content:" ]"}.mw-parser-output .navbar li{word-spacing:-0.125em}.mw-parser-output .navbar a>span,.mw-parser-output .navbar a>abbr{text-decoration:inherit}.mw-parser-output .navbar-mini abbr{font-variant:small-caps;border-bottom:none;text-decoration:none;cursor:inherit}.mw-parser-output .navbar-ct-full{font-size:114%;margin:0 7em}.mw-parser-output .navbar-ct-mini{font-size:114%;margin:0 4em}html.skin-theme-clientpref-night .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}@media(prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}}@media print{.mw-parser-output .navbar{display:none!important}}

/* end https://en.wikipedia.org/ */

</style></div><div role="navigation" class="navbox" aria-label="Navbox0" style="padding:3px"><table class="nowraplinks hlist navbox-inner" style="border-spacing:0;background:transparent;color:inherit"><tbody><tr><td colspan="2" class="navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em"></div><table class="nowraplinks navbox-subgroup" style="border-spacing:0"><tbody><tr><td colspan="2" class="navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em"></div><table class="nowraplinks navbox-subgroup" style="border-spacing:0"><tbody><tr><th scope="col" class="navbox-title" colspan="2"><div id="Block_ciphers_(security_summary)197" style="font-size:114%;margin:0 4em"><a href="Block_cipher" title="Block cipher">Block ciphers</a> (<a href="Cipher_security_summary" title="Cipher security summary">security summary</a>)</div></th></tr><tr><th scope="row" class="navbox-group" style="width:1%">Common<br>algorithms</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<li><a href="Blowfish_(cipher)" title="Blowfish (cipher)">Blowfish</a></li>

<li><a href="Data_Encryption_Standard" title="Data Encryption Standard">DES</a> (<a href="DES_supplementary_material" title="DES supplementary material">internal mechanics</a>, <a href="Triple_DES" title="Triple DES">Triple DES</a>)</li>

<li><a href="Serpent_(cipher)" title="Serpent (cipher)">Serpent</a></li>

<li><a href="Twofish" title="Twofish">Twofish</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Less common<br>algorithms</th><td class="navbox-list-with-group navbox-list navbox-even hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<li><a href="Camellia_(cipher)" title="Camellia (cipher)">Camellia</a></li>

<li><a href="Skipjack_(cipher)" title="Skipjack (cipher)">Skipjack</a></li>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Other<br>algorithms</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<li><a href="Adiantum_(cipher)" title="Adiantum (cipher)">Adiantum</a></li>

<li><a href="Akelarre_(cipher)" title="Akelarre (cipher)">Akelarre</a></li>

<li><a href="Anubis_(cipher)" title="Anubis (cipher)">Anubis</a></li>

<li><a href="Ascon_(cipher)" title="Ascon (cipher)">Ascon</a></li>

<li><a href="BaseKing" title="BaseKing">BaseKing</a></li>

<li><a href="BassOmatic" title="BassOmatic">BassOmatic</a></li>

<li><a href="BATON" title="BATON">BATON</a></li>

<li><a href="Chiasmus_(cipher)" title="Chiasmus (cipher)">Chiasmus</a></li>

<li><a href="CIPHERUNICORN-A" title="CIPHERUNICORN-A">CIPHERUNICORN-A</a></li>

<li><a href="CIPHERUNICORN-E" title="CIPHERUNICORN-E">CIPHERUNICORN-E</a></li>

<li><a href="CLEFIA" title="CLEFIA">CLEFIA</a></li>

<li><a href="Cobra_ciphers" title="Cobra ciphers">Cobra</a></li>

<li><a href="COCONUT98" title="COCONUT98">COCONUT98</a></li>

<li><a href="Cryptomeria_cipher" title="Cryptomeria cipher">Cryptomeria/C2</a></li>

<li><a href="CRYPTON" title="CRYPTON">CRYPTON</a></li>

<li><a href="CS-Cipher" title="CS-Cipher">CS-Cipher</a></li>

<li><a href="Grand_Cru_(cipher)" title="Grand Cru (cipher)">Grand Cru</a></li>

<li><a href="Hasty_Pudding_cipher" title="Hasty Pudding cipher">Hasty Pudding cipher</a></li>

<li><a href="Hierocrypt" title="Hierocrypt">Hierocrypt</a></li>

<li><a href="Intel_Cascade_Cipher" title="Intel Cascade Cipher">Intel Cascade Cipher</a></li>

<li><a href="Iraqi_block_cipher" title="Iraqi block cipher">Iraqi</a></li>

<li><a href="Kalyna_(cipher)" title="Kalyna (cipher)">Kalyna</a></li>

<li><a href="KASUMI" title="KASUMI">KASUMI</a></li>

<li><a href="KeeLoq" title="KeeLoq">KeeLoq</a></li>

<li><a href="KHAZAD" title="KHAZAD">KHAZAD</a></li>

<li><a href="Khufu_and_Khafre" title="Khufu and Khafre">Khufu and Khafre</a></li>

<li><a href="KN-Cipher" title="KN-Cipher">KN-Cipher</a></li>

<li><a href="Kuznyechik" title="Kuznyechik">Kuznyechik</a></li>

<li><a href="Ladder-DES" title="Ladder-DES">Ladder-DES</a></li>

<li><a href="Lucifer_(cipher)" title="Lucifer (cipher)">Lucifer</a></li>

<li><a href="MacGuffin_(cipher)" title="MacGuffin (cipher)">MacGuffin</a></li>

<li><a href="Madryga" title="Madryga">Madryga</a></li>

<li><a href="MAGENTA" title="MAGENTA">MAGENTA</a></li>

<li><a href="Mercy_(cipher)" title="Mercy (cipher)">Mercy</a></li>

<li><a href="MISTY1" title="MISTY1">MISTY1</a></li>

<li><a href="MULTI2" title="MULTI2">MULTI2</a></li>

<li><a href="MultiSwap" title="MultiSwap">MultiSwap</a></li>

<li><a href="NewDES" title="NewDES">NewDES</a></li>

<li><a href="Nimbus_(cipher)" title="Nimbus (cipher)">Nimbus</a></li>

<li><a href="NOEKEON" title="NOEKEON">NOEKEON</a></li>

<li><a href="PRESENT" title="PRESENT">PRESENT</a></li>

<li><a href="Prince_(cipher)" title="Prince (cipher)">Prince</a></li>

<li><a href="QARMA" title="QARMA">QARMA</a></li>

<li><a href="REDOC" title="REDOC">REDOC</a></li>

<li><a href="Secure_and_Fast_Encryption_Routine" title="Secure and Fast Encryption Routine">SAFER</a></li>

<li><a href="SAVILLE" title="SAVILLE">SAVILLE</a></li>

<li><a href="SHACAL" title="SHACAL">SHACAL</a></li>

<li><a href="SHARK" title="SHARK">SHARK</a></li>

<li><a href="Simon_(cipher)" title="Simon (cipher)">Simon</a></li>

<li><a href="Speck_(cipher)" title="Speck (cipher)">Speck</a></li>

<li><a href="Spectr-H64" title="Spectr-H64">Spectr-H64</a></li>

<li><a href="Square_(cipher)" title="Square (cipher)">Square</a></li>

<li><a href="Threefish" title="Threefish">Threefish</a></li>

<li><a href="Treyfer" title="Treyfer">Treyfer</a></li>

<li><a href="XXTEA" title="XXTEA">XXTEA</a></li>

<li><a href="Zodiac_(cipher)" title="Zodiac (cipher)">Zodiac</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Design</th><td class="navbox-list-with-group navbox-list navbox-even hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Feistel_cipher" title="Feistel cipher">Feistel network</a></li>

<li><a href="Key_schedule" title="Key schedule">Key schedule</a></li>

<li><a href="Lai%E2%80%93Massey_scheme" title="Lai–Massey scheme">Lai–Massey scheme</a></li>

<li><a href="Product_cipher" title="Product cipher">Product cipher</a></li>

<li><a href="Confusion_and_diffusion" title="Confusion and diffusion">Confusion and diffusion</a></li>

<li><a href="Round_(cryptography)" title="Round (cryptography)">Round</a></li>

<li><a href="Avalanche_effect" title="Avalanche effect">Avalanche effect</a></li>

<li><a href="Block_size_(cryptography)" title="Block size (cryptography)">Block size</a></li>

<li><a href="Key_whitening" title="Key whitening">Key whitening</a> (<a href="Whitening_transformation" title="Whitening transformation">Whitening transformation</a>)</li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Attack<br>(<a href="Cryptanalysis" title="Cryptanalysis">cryptanalysis</a>)</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Brute-force_attack" title="Brute-force attack">Brute-force</a> (<a href="EFF_DES_cracker" title="EFF DES cracker">EFF DES cracker</a>)</li>

<ul><li><a href="Biclique_attack" title="Biclique attack">Biclique attack</a></li>

<li><a href="3-subset_meet-in-the-middle_attack" title="3-subset meet-in-the-middle attack">3-subset MITM attack</a></li></ul></li>

<li><a href="Linear_cryptanalysis" title="Linear cryptanalysis">Linear</a> (<a href="Piling-up_lemma" title="Piling-up lemma">Piling-up lemma</a>)</li>

<li><a href="Differential_cryptanalysis" title="Differential cryptanalysis">Differential</a>

<ul><li><a href="Impossible_differential_cryptanalysis" title="Impossible differential cryptanalysis">Impossible</a></li>

<li><a href="Truncated_differential_cryptanalysis" title="Truncated differential cryptanalysis">Truncated</a></li>

<li><a href="Higher-order_differential_cryptanalysis" title="Higher-order differential cryptanalysis">Higher-order</a></li></ul></li>

<li><a href="Differential-linear_attack" title="Differential-linear attack">Differential-linear</a></li>

<li><a href="Distinguishing_attack" title="Distinguishing attack">Distinguishing</a> (<a href="Known-key_distinguishing_attack" title="Known-key distinguishing attack">Known-key</a>)</li>

<li><a href="Integral_cryptanalysis" title="Integral cryptanalysis">Integral/Square</a></li>

<li><a href="Boomerang_attack" title="Boomerang attack">Boomerang</a></li>

<li><a href="Related-key_attack" title="Related-key attack">Related-key</a></li>

<li><a href="Slide_attack" title="Slide attack">Slide</a></li>

<li><a href="Rotational_cryptanalysis" title="Rotational cryptanalysis">Rotational</a></li>

<li><a href="Side-channel_attack" title="Side-channel attack">Side-channel</a>

<ul><li><a href="Timing_attack" title="Timing attack">Timing</a></li>

<li><a href="Power_analysis" title="Power analysis">Power-monitoring</a></li>

<li><a href="Electromagnetic_attack" title="Electromagnetic attack">Electromagnetic</a></li>

<li><a href="Acoustic_cryptanalysis" title="Acoustic cryptanalysis">Acoustic</a></li>

<li><a href="Differential_fault_analysis" title="Differential fault analysis">Differential-fault</a></li></ul></li>

<li><a href="Interpolation_attack" title="Interpolation attack">Interpolation</a></li>

<li><a href="Partitioning_cryptanalysis" title="Partitioning cryptanalysis">Partitioning</a></li>

<li><a href="Rubber-hose_cryptanalysis" class="mw-redirect" title="Rubber-hose cryptanalysis">Rubber-hose</a></li>

<li><a href="Black-bag_cryptanalysis" title="Black-bag cryptanalysis">Black-bag</a></li>

<li><a href="Davies_attack" title="Davies attack">Davies</a></li>

<li><a href="Rebound_attack" title="Rebound attack">Rebound</a></li>

<li><a href="Chi-squared_test" title="Chi-squared test">Chi-square</a></li>

<li><a href="Time/memory/data_tradeoff_attack" title="Time/memory/data tradeoff attack">Time/memory/data tradeoff</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Standardization</th><td class="navbox-list-with-group navbox-list navbox-even hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Advanced_Encryption_Standard_process" title="Advanced Encryption Standard process">AES process</a></li>

<li><a href="CRYPTREC" title="CRYPTREC">CRYPTREC</a></li>

<li><a href="NESSIE" title="NESSIE">NESSIE</a></li>

<li><a href="NSA_Suite_B_Cryptography" title="NSA Suite B Cryptography">NSA Suite B</a></li>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Utilization</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Initialization_vector" title="Initialization vector">Initialization vector</a></li>

<li><a href="Block_cipher_mode_of_operation" title="Block cipher mode of operation">Mode of operation</a></li>

</ul>

</div></td></tr></tbody></table><div></div></td></tr></tbody></table><div></div></td></tr><tr><td colspan="2" class="navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em"></div><table class="nowraplinks mw-collapsible mw-collapsed navbox-subgroup" style="border-spacing:0"><tbody><tr><th scope="col" class="navbox-title" colspan="2"><div id="Cryptography149" style="font-size:114%;margin:0 4em"><a href="Cryptography" title="Cryptography">Cryptography</a></div></th></tr><tr><th scope="row" class="navbox-group" style="width:1%">General</th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="History_of_cryptography" title="History of cryptography">History of cryptography</a></li>

<li><a href="Outline_of_cryptography" title="Outline of cryptography">Outline of cryptography</a></li>

<li><a href="Classical_cipher" title="Classical cipher">Classical cipher</a></li>

<li><a href="Cryptographic_protocol" title="Cryptographic protocol">Cryptographic protocol</a>

<ul><li><a href="Authentication_protocol" title="Authentication protocol">Authentication protocol</a></li></ul></li>

<li><a href="Cryptographic_primitive" title="Cryptographic primitive">Cryptographic primitive</a></li>

<li><a href="Cryptanalysis" title="Cryptanalysis">Cryptanalysis</a></li>

<li><a href="Cryptocurrency" title="Cryptocurrency">Cryptocurrency</a></li>

<li><a href="Cryptosystem" title="Cryptosystem">Cryptosystem</a></li>

<li><a href="Cryptographic_nonce" title="Cryptographic nonce">Cryptographic nonce</a></li>

<li><a href="Cryptovirology" title="Cryptovirology">Cryptovirology</a></li>

<li><a href="Hash_function" title="Hash function">Hash function</a>

<ul><li><a href="Cryptographic_hash_function" title="Cryptographic hash function">Cryptographic hash function</a></li>

<li><a href="Key_derivation_function" title="Key derivation function">Key derivation function</a></li>

<li><a href="Secure_Hash_Algorithms" title="Secure Hash Algorithms">Secure Hash Algorithms</a></li></ul></li>

<li><a href="Digital_signature" title="Digital signature">Digital signature</a></li>

<li><a href="Kleptography" title="Kleptography">Kleptography</a></li>

<li><a href="Key_(cryptography)" title="Key (cryptography)">Key (cryptography)</a></li>

<li><a href="Key_exchange" title="Key exchange">Key exchange</a></li>

<li><a href="Key_generator" title="Key generator">Key generator</a></li>

<li><a href="Key_schedule" title="Key schedule">Key schedule</a></li>

<li><a href="Key_stretching" title="Key stretching">Key stretching</a></li>

<li><a href="Keygen" title="Keygen">Keygen</a></li>

<li>Machines</li>

<li><a href="Cryptojacking_malware" class="mw-redirect" title="Cryptojacking malware">Cryptojacking malware</a></li>

<li><a href="Ransomware" title="Ransomware">Ransomware</a></li>

<li><a href="Random_number_generation" title="Random number generation">Random number generation</a>

<ul><li><a href="Cryptographically_secure_pseudorandom_number_generator" title="Cryptographically secure pseudorandom number generator">Cryptographically secure pseudorandom number generator</a> (CSPRNG)</li></ul></li>

<li><a href="Pseudorandom_noise" title="Pseudorandom noise">Pseudorandom noise</a> (PRN)</li>

<li><a href="Secure_channel" title="Secure channel">Secure channel</a></li>

<li><a href="Insecure_channel" class="mw-redirect" title="Insecure channel">Insecure channel</a></li>

<li><a href="Subliminal_channel" title="Subliminal channel">Subliminal channel</a></li>

<li><a href="Encryption" title="Encryption">Encryption</a></li>

<li><a href="Decryption" class="mw-redirect" title="Decryption">Decryption</a></li>

<li><a href="End-to-end_encryption" title="End-to-end encryption">End-to-end encryption</a></li>

<li><a href="Harvest_now%2C_decrypt_later" title="Harvest now, decrypt later">Harvest now, decrypt later</a></li>

<li><a href="Information-theoretic_security" title="Information-theoretic security">Information-theoretic security</a></li>

<li><a href="Plaintext" title="Plaintext">Plaintext</a></li>

<li><a href="Codetext" class="mw-redirect" title="Codetext">Codetext</a></li>

<li><a href="Ciphertext" title="Ciphertext">Ciphertext</a></li>

<li><a href="Shared_secret" title="Shared secret">Shared secret</a></li>

<li><a href="Trapdoor_function" title="Trapdoor function">Trapdoor function</a></li>

<li><a href="Trusted_timestamping" title="Trusted timestamping">Trusted timestamping</a></li>

<li><a href="Key-based_routing" title="Key-based routing">Key-based routing</a></li>

<li><a href="Onion_routing" title="Onion routing">Onion routing</a></li>

<li><a href="Garlic_routing" title="Garlic routing">Garlic routing</a></li>

<li><a href="Kademlia" title="Kademlia">Kademlia</a></li>

<li><a href="Mix_network" title="Mix network">Mix network</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Mathematics</th><td class="navbox-list-with-group navbox-list navbox-even" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Cryptographic_hash_function" title="Cryptographic hash function">Cryptographic hash function</a></li>

<li><a href="Block_cipher" title="Block cipher">Block cipher</a></li>

<li><a href="Stream_cipher" title="Stream cipher">Stream cipher</a></li>

<li><a href="Symmetric-key_algorithm" title="Symmetric-key algorithm">Symmetric-key algorithm</a></li>

<li><a href="Authenticated_encryption" title="Authenticated encryption">Authenticated encryption</a></li>

<li><a href="Public-key_cryptography" title="Public-key cryptography">Public-key cryptography</a></li>

<li><a href="Quantum_key_distribution" title="Quantum key distribution">Quantum key distribution</a></li>

<li><a href="Quantum_cryptography" title="Quantum cryptography">Quantum cryptography</a></li>

<li><a href="Post-quantum_cryptography" title="Post-quantum cryptography">Post-quantum cryptography</a></li>

<li><a href="Message_authentication_code" title="Message authentication code">Message authentication code</a></li>

<li><a href="Cryptographically_secure_pseudorandom_number_generator" title="Cryptographically secure pseudorandom number generator">Random numbers</a></li>

<li><a href="Steganography" title="Steganography">Steganography</a></li></ul>

</div></td></tr><tr><td class="navbox-abovebelow" colspan="2"><div>

<ul><li><span class="noviewer" typeof="mw:File"><span title="Category"></span></span> Category</li></ul>

</div></td></tr></tbody></table><div></div></td></tr></tbody></table></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-06-21" href="https://en.wikipedia.org/wiki/?title=Padding_(cryptography)&oldid=1296731881">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>