liveBook · Manning

Padding

As explained in Software Security for Developers

Padding is the addition of extra data so that an input conforms to a required fixed block size or cryptographic encoding format.

Padding adds extra data so input fits a required cryptographic format. AES accepts exactly 16-byte blocks, so shorter input needs padding before encryption; longer input is divided into blocks. section 5.1 section 5.2

A final partial block

A 1,605-byte message becomes 1,001 AES blocks: 1,000 complete blocks and a final 5-byte block containing 11 bytes of padding. A mode of operation then specifies how those blocks are encrypted. section 5.2

Padding also protects an RSA encryption scheme when it adds random data before encryption. OAEP is recommended because it provides stronger security guarantees than the older PKCS#1 v1.5 scheme; applications should reject the older scheme rather than preserve insecure compatibility. section 6.3.1

Figure 5.2 AES is a block cipher because it requires its input to be a fixed size: 128 bits. AES is a symmetric cipher because the key used for encryption is the same one used for decryption.
figure

Use the fixed-size AES diagram to connect padding with block-cipher input requirements. section 5.1

How Software Security for Developers covers it

How deep it goes
Demonstrates block sizing and contrasts RSA schemes, but stops short of specifying padding bytes or implementing padding code.
Examples
Uses a 1,605-byte AES message and RSA comparisons between OAEP and PKCS#1 v1.5.
What it assumes
Assumes basic encryption familiarity while defining block ciphers, fixed-size input, modes of operation, and RSA padding choices.
What you can do after
Evaluate padding choices by matching AES block requirements and preferring OAEP over RSA PKCS#1 v1.5.
How it connects
Connects padding with AES, block ciphers, modes of operation, RSA, OAEP, and PKCS#1 v1.5.

Also explained in

Compare how 19 books explain padding →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Software Security for Developers. The section links point to the parts of the book it draws on.