Size of decrypted data with AES/ECB

Question

Is there a way to figure out the original size of AES/ECB decrypted binary (0x00 is not the end) data without storing it explicitly?

Answer 1

It depends on which padding was used. The mode of operation has no influence on that other than it must not be a streaming mode. Streaming modes like CTR don't need any padding scheme.

The paddings work by filling up the plaintext up to the next multiple of the block size. Some add an additional block and some don't. There are two common padding schemes for block ciphers.

PKCS#5/PKCS#7 paddings (reliable)

The plaintext is padded with bytes that denote the number of padding bytes. The padding is always applied even if a full block of padding must be added. Since the size of the padding is encoded in the padding itself, it can be easily and reliably removed.

You can calculate the size of the data in the following way

plaintextLength = paddedLength - int(byteAtLastPosition)

You may also want to check the other int(byteAtLastPosition)-1 padding bytes whether they contain byteAtLastPosition.

Zero padding (unreliable)

The padding bytes are all 0x00 bytes. If your plaintext can end in 0x00, then you run the risk of accidentally removing plaintext bytes when removing the padding. There is no way to distinguish 0x00 bytes belonging to the padding and those belonging to the plaintext alone from the decrypted plaintext. You can however send the length of the plaintext along with the ciphertext message.

Some implementations differ whether they add a full block of padding or not when the plaintext is already a multiple of the block size, which shouldn't make a difference when removing the padding.

Other padding schemes for block ciphers

Bit padding or ISO/IEC 9797-1 Padding Method 2 (reliable)

The padding is works by adding a 1 bit followed by as many 0 bits to fill up a multiple of the block size. If working on bytes this looks like a 0x80 byte followed by 0x00 bytes. Since the start of the padding is clearly defined, it can be reliably removed.

ISO 10126 padding (reliable)

This is very similar to PKCS#7 padding with the distinction that the first to the second to last padding bytes are chosen randomly. Only the last padding byte encodes the number of padding bytes.

ANSI X.923 padding (reliable)

This is very similar to PKCS#7 padding with the distinction that the first to the second to last padding bytes are 0x00 bytes and the last padding byte encodes the number of padding bytes.