Inadequate encryption strength due to inadequate padding
ID |
dart.cryptography.inadequate_padding |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Cryptography |
Language |
Dart |
Description
An obsolete or unsafe cryptographic padding is used: NoPadding / ZeroBytePadding with a block cipher, or PKCS#1 v1.5 with RSA. Both enable padding-oracle attacks or produce ambiguous decryption.
Rationale
Two distinct padding failures fall under CWE-325:
-
Block-cipher padding: NoPadding requires the plaintext to be an exact multiple of the block size (rare and error-prone), and silently truncates or corrupts otherwise. ZeroBytePadding cannot distinguish legitimate trailing zero bytes from padding, producing ambiguous decryption and enabling padding-oracle-style information leaks. Both leave the message length-modulo-block-size detectable. PKCS#7 is the correct choice for CBC; AEAD modes (GCM / CCM) need no padding.
-
RSA padding: PKCS#1 v1.5 has known padding-oracle attacks (Bleichenbacher 1998, recurring as ROBOT in 2017). A server that reveals "decryption failed" vs "decryption succeeded" allows recovery of arbitrary ciphertexts in millions of queries. Use OAEP for RSA encryption and PSS for RSA signatures.
The following code illustrates a vulnerable pattern detected by this rule:
class BadPadding {
void pcZero() {
// VULNERABLE: Inadequate encryption strength due to inadequate padding
final pad = ZeroBytePadding();
print('$pad');
}
}Remediation
Match the cipher to a known-safe padding/scheme combination:
-
AES-CBC + PKCS#7 (default in
package:encrypt) -
AES-GCM / AES-CCM / ChaCha20-Poly1305 (AEAD, no padding needed)
-
RSA encryption: OAEP with SHA-256 (or stronger)
-
RSA signing: PSS with SHA-256 (or stronger)
// Vulnerable
PaddedBlockCipher('AES/CBC/NoPadding');
PaddedBlockCipher('AES/CBC/ZeroBytePadding');
PKCS1Encoding(RSAEngine());
AES(key, mode: AESMode.cbc, padding: null);
RSA(publicKey: pub, encoding: RSAEncoding.PKCS1);
// Fixed
PaddedBlockCipher('AES/CBC/PKCS7');
OAEPEncoding(RSAEngine());
AES(key, mode: AESMode.gcm); // AEAD — no padding
RSA(publicKey: pub, encoding: RSAEncoding.OAEP);References
-
OWASP Top 10 2025 - A04 : Cryptographic Failures.
-
Padding Oracle Attack (Wikipedia) — Generic attack against block ciphers with malleable padding
-
ROBOT — Return Of Bleichenbacher’s Oracle Threat — 2017 reincarnation of the PKCS#1 v1.5 padding oracle against modern stacks
-
RFC 8017 — PKCS — OAEP and PSS specifications for RSA