On Hiding a Plaintext Length by Preencryption

Abstract

Abstract. It is a well known fact that encryption schemes cannot hide a plaintext length when it is unbounded. We thus admit that an approximation of it may leak and we focus on hiding its precise value. Some standards such as TLS or SSH offer to do it by applying some pad-then-encrypt techniques. In this study, we investigate the information leakage when these techniques are used. We define the notion of padding scheme and its associated security. We show that when a padding length is uniformly distributed, the scheme is nearly optimal. We also show that the insecurity degrades linearly with the padding length.

Report on the Block Cipher Modes of Operation in the 800-38 Series

“…It can be argued that this property is somewhat inevitable. Tezcan and Vaudenay [77] state that: "Practically, we can always distinguish an encrypted [text] message from an encrypted [high definition] video stream." However, in a real-world application, a meaningful notion of confidentiality may not be achieved if it is possible for an adversary to guess which text message or video stream was encrypted based on the ciphertext length.…”

Security of Symmetric Encryption in the Presence of Ciphertext Fragmentation

“…The SSH Binary Packet Protocol and the TLS Record Protocol both adopt this approach. This mechanism has recently received attention from differing perspectives [16,18]. Secondly, an encryption scheme may be designed in such a way that it is hard to distinguish where the boundaries between ciphertexts lie in a stream of ciphertexts.…”