0

I am trying to encrypt/decrypt data using AES 128 bit with zero padding. I can encrypt/decrypt fine if I don't attempt to futz with the padding mode (defaults to PKCS5_PADDING), so the following snippet of code is to show where things are breaking down:

// sanity check -- is key configured how I expect?
CryptGetKeyParam(hKey, KP_KEYLEN, temp, &tempSz, 0);
CryptGetKeyParam(hKey, KP_ALGID, temp, &tempSz, 0);
CryptGetKeyParam(hKey, KP_MODE, temp, &tempSz, 0);
CryptGetKeyParam(hKey, KP_PADDING, temp, &tempSz, 0);
// force padding to zero padding
DWORD padding = ZERO_PADDING;
CryptSetKeyParam(hKey, KP_PADDING, (PBYTE)&padding, 0);

each of the queries operates without issue with values: 128, 0x0000660e (CALG_AES_128), 1 (CRYPT_MODE_CBC) and 1 (PKCS5_PADDING) -- that is the default state.

then I attempt to set the padding to ZERO_PADDING (3) and the function returns FALSE with a last error of NTE_BAD_DATA. I tried, for giggles, to set it to PKCS5_PADDING -- no error. RANDOM_PADDING: error.

searching the interwebs as I might, I cannot find any documentation to suggest why changing the padding should fail (not even a note saying only PKCS5_PADDING is allowed for certain key algorithms).

does anyone have any advice?

rguilbault
  • 553
  • 1
  • 5
  • 17
  • Which service provider are you using? – Collin Dauphinee Jan 15 '16 at 00:26
  • Note that null padding does not work if the last byte of the input data is null (0x00). Note: When you see PKCS#5 for AES padding the docs have not been updated, AES requires PKCS#7 padding but the good news is that due to actual implementations PKCS#5 also supports PKCS#7. – zaph Jan 15 '16 at 02:26

1 Answers1

2

The cryptographic service providers provided by Microsoft only support PKCS5_PADDING.

See https://msdn.microsoft.com/en-us/library/windows/desktop/aa380272(v=vs.85).aspx for reference; search for KP_PADDING.

Collin Dauphinee
  • 13,664
  • 1
  • 40
  • 71
  • grr....I read and reread that doc so many times. totally missed the line about it not being supported by MS providers. – rguilbault Jan 15 '16 at 01:16