Padding appends structured data to an input so its length reaches the block size required by a cipher or compression function. The added data must be reversible when the original input must be recovered; arbitrary random bytes would not reveal where the input ends. section 4.3 section 2.5.1
Padding appears in several related workflows:
- Block-cipher padding fills a short final block. PKCS#7 sets every padding byte to the number of bytes added, including a full block when the plaintext already fits exactly. section 4.3
- Hash-function padding makes the input length a multiple of the compression function’s block size before the message is divided into equal blocks. section 2.5.1
- TLS 1.3 record padding adds a configurable random number of zero bytes before encryption to obscure an application message’s true length, although statistical attacks may reduce the benefit. section 9.2.2
An eight-byte message in AES
AES processes 16-byte blocks. An eight-byte plaintext receives eight padding bytes, each containing the value 8, producing one complete block. During decryption, the final byte indicates that eight bytes should be removed. section 4.3
Figure 4.6 If the plaintext is not a multiple of the block size, it is padded with the length needed to reach a multiple of the block size. In the figure, the plaintext is 8 bytes, so we use 8 more bytes (containing the value 8) to pad the plaintext up to the 16 bytes required for AES.
Visualize how an eight-byte plaintext becomes a 16-byte AES block through eight repeated padding bytes. section 4.3
