AES (block length 16 bytes) is used in CBC mode with PKCS#7 padding. In PKCS#7, if n bytes are missing, n bytes of value n are added, and even when the plaintext length is exactly a multiple of 16, 16 bytes of value 16 are added. Which of the following is the length of the ciphertext (not including the IV) when a 96-byte plaintext is encrypted?

Answer: B. 112 bytes

96 bytes is exactly 6 blocks of 16 bytes, but PKCS#7 adds a block of sixteen bytes of value 16 even when the length divides evenly. The plaintext therefore becomes 96 + 16 = 112 bytes (7 blocks), and so does the ciphertext. Padding is added even in that case so that the decrypting side can always remove the padding by looking at the value of the last byte. Modes that XOR with a keystream, such as CTR mode and GCM, need no padding, and the ciphertext has the same length as the plaintext.

• A. This is the value without padding. PKCS#7 adds a block of padding even when the length divides exactly.
• B. Correct. 96 + 16 = 112 bytes.
• C. This is 112 bytes plus the 16 bytes of the IV.