Padding Schemes Reference

Block Cipher Padding

Block-aligned modes like CBC require the plaintext length to be a multiple of the block size, so padding extends the final block. PKCS#7 is the dominant scheme: it appends N bytes each valued N, where N is the number of padding bytes added. When the plaintext is already block-aligned, a full block of padding is added so removal is unambiguous. Verifying the padding during decryption must be constant-time to avoid padding oracle attacks.

PKCS#7

N bytes of value N, 1 to blocksize

AES: ... | 03 03 03

Zero padding

Append zeros, cannot handle trailing zeros

ambiguous

ISO 10126

Random bytes then length byte last

... | rand 03

ANSI X.923

Zeros then length byte last

... | 00 00 03

RSA Padding

Raw RSA encryption without padding is deterministic and insecure, so padding schemes randomize the input. PKCS#1 v1.5 padding is simple but vulnerable to Bleichenbacher oracle attacks in many implementations. OAEP (Optimal Asymmetric Encryption Padding) is the modern choice, providing provable security under the random oracle model. For signatures, PSS replaces the older v1.5 scheme with similar security improvements.

Removing Padding Safely

Decryption must validate padding before stripping it, and validation must run in constant time regardless of how many padding bytes are present. A padding oracle leaks whether padding is valid, which an attacker can exploit to decrypt arbitrary ciphertexts byte by byte. The best defense is to use authenticated encryption so that invalid padding never reaches the application. Never expose padding errors to callers in a distinguishable way.