2

I am studying AES algorithm, as far as I know, encrypting a 16 bytes plaintext will result in a 16 bytes ciphertext. But I got a different result when trying to encrypt a 16 bytes plaintext using AES-128-CBC. I got a 32 bytes ciphertext instead

I went to this website https://legacy.cryptool.org/en/cto/aes-step-by-step I tried the AES-CBC-128 Test Vector#1:

algorithm: AES-128-CBC

plaintext: 6b c1 be e2 2e 40 9f 96 e9 3d 7e 11 73 93 17 2a

iv: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f

key: 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c

But the ciphertext output is

76 49 ab ac 81 19 b2 46 ce e9 8e 9b 12 e9 19 7d 89 64 e0 b1 49 c1 0b 7b 68 2e 6e 39 aa eb 73 1c

Why is the output 32 bytes long, I thought the output should be 16 bytes long? This also happens with other 16 bytes plaintext that I tried to encrypt.

kelalaka
  • 49,797
  • 12
  • 123
  • 211
user25513320
  • 21
  • 1

1 Answers1

5

CBC mode requires

  1. A nonce ( it was stated as IV for CBC but it is nonce - number used once);

    • so that we can have probabilistic encryption, i.e. even if we have the same plaintext and ciphertext we will have a different one. This is a must to achieve CPA security.
    • The nonce must be random and in the case of network it must be unpredictable.
    • The size of nonce is the block size of the block cipher, and in the case of AES, it is 16 bytes.
    • The nonce is commonly prepended ( as a prefix ) to the ciphertext ( tags are appended ). Separately sending them or forming a JSON object etc. is also possible.

  2. A padding;

    • A $b$ block sized cipher can output $b$ bits at once. Depending on the mode of operation, we may need padding.
    • CBC encrypted as $C_i = E(k, C_{i-1} \oplus P_i)$ with $C_0 = nonce$, we need full block-sized input ( plaintext) for the encryption algorithm.
    • The common way to pad for the CBC mode is the PKCS#7 padding
    • Padding is appended to plaintext before encryption.

  3. PKCS#7 padding;

    • The padding depends on the size of the plaintext $l$ on the last block. If the block size is $b$ then the padding is performed as
              01 -- if l mod b = b-1
           02 02 -- if l mod b = b-2
                 ..     
     b b ... b b -- if l mod b = 0

  1. Your case;

    • You have 16 bytes
    • This means that you have a full-size block. Due to the padding - the last line - we need an additional block full of 0x10 contributing to an additional one block encryption.

  2. Conclusion;

    • You had two ciphertext blocks which makes 32 bytes.
    • Your online sites don't include the nonce as the output. This a mistake. In general, without the nonce(IV), we cannot decrypt the ciphertext, well, in CBC mode only the first plaintext block cannot be decrypted.
    • 16 bytes nonce, 16 bytes plaintext, and 16 bytes padding make 48-byte output as the actual ciphertext size.
kelalaka
  • 49,797
  • 12
  • 123
  • 211