PKCS#7 padding makes plaintext fit a block cipher by appending repeated bytes whose value equals the number of bytes added. For example, four added bytes become 0x04 0x04 0x04 0x04. When plaintext already fills the final block, an entire block of padding is appended. section 5.2
Padding removal uses the final byte to determine how many bytes to remove. Validation must first confirm that this value is positive, within the data length, and repeated across every padding byte; otherwise, malformed ciphertext can be accepted or produce misleading results. section 5.4.1
A safe implementation follows these rules:
- Do not expose whether padding validation failed through distinguishable API errors. section 5.4.1 section 5.6
Padding oracle exposure
A server encrypts timestamps with AES-CBC and later decrypts submitted ciphertext. If invalid padding produces an identifiable error before timestamp parsing, the response reveals whether the decrypted plaintext has valid PKCS#7 padding. That distinction creates a padding oracle and can let an attacker decrypt the message without learning the key. section 5.4.1
