Secure Programming Cookbook for C and C++

5.11. Manually Adding and Checking Cipher Padding

Problem

You want to add padding to data manually, then check it manually when decrypting.

Solution

There are many subtle ways in which padding can go wrong, so use an off-the-shelf scheme, such as PKCS block cipher padding.

Discussion

Tip

Padding is applied to plaintext; when decrypting, you must check for proper padding of the resulting data to determine where the plaintext message actually ends.

Generally, it is not a good idea to add padding yourself. If you’re using a reasonably high-level abstraction, padding will be handled for you. In addition, padding often isn’t required, for example, when using a stream cipher or one of many common block cipher modes (including CWC, CTR, CCM, OFB, and CFB).

Because ECB mode really shouldn’t be used for stream-based encryption, the only common case where padding is actually interesting is when you’re using CBC mode.

If you are in a situation where you do need padding, we recommend that you use a standard scheme. There are many subtle things that can go wrong (although the most important requirement is that padding always be unambiguous^[13]), and there’s no good reason to wing it.

The most widespread standard padding for block ciphers is called PKCS block padding. The goal of PKCS block padding is that the last byte of the padded plaintext should unambiguously describe how much padding was added to the message. PKCS padding sets every byte of padding to the number of bytes of padding added. If the ...