Powershell "Padding is invalid and cannot be removed" error - powershell

Question

I'm trying to decrypt a string in Powershell and am getting this error. What could be wrong?

Answer 1

This exception can represent a lot of different things, and not all of them are related to the padding, so I have tried to catalogue all the different scenarios where this can occur.
If you know of another situation where this padding exception is thrown, please add it.
To start, this is an example of encryption/decryption that works as expected.
$testData = "Hi there! This is a test of a string during encryption"
$enc = [system.Text.Encoding]::UTF8
$data = $enc.getBytes($testData)
# Encrypt some data
$encryptAlgorithm = [System.Security.Cryptography.SymmetricAlgorithm] (New-Object System.Security.Cryptography.AesCryptoServiceProvider)
$encryptAlgorithm.Mode = [System.Security.Cryptography.CipherMode]::CBC
$encryptAlgorithm.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
$encryptAlgorithm.KeySize = 128
$encryptAlgorithm.BlockSize = 128
$encryptAlgorithm.Key = #(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16)
$encryptAlgorithm.IV = #(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16)
$encryptor = [System.Security.Cryptography.ICryptoTransform]$encryptAlgorithm.CreateEncryptor()
$encryptorMemoryStream = new-Object IO.MemoryStream
$encryptorCryptoStream = new-Object Security.Cryptography.CryptoStream $encryptorMemoryStream,$encryptor,"Write"
$encryptorCryptoStream.Write($data, 0, $data.Length)
$encryptorCryptoStream.FlushFinalBlock();
$encryptedData = $encryptorMemoryStream.ToArray()
Write-Host $enc.GetString($encryptedData)
Write-Host $encryptedData.Length
# Decrypt some data
$descryptAlgorithm = [System.Security.Cryptography.SymmetricAlgorithm] (New-Object System.Security.Cryptography.AesCryptoServiceProvider)
$descryptAlgorithm.Mode = [System.Security.Cryptography.CipherMode]::CBC
$descryptAlgorithm.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
$descryptAlgorithm.KeySize = 128
$descryptAlgorithm.BlockSize = 128
$descryptAlgorithm.Key = #(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16)
$descryptAlgorithm.IV = #(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16)
$decryptor = [System.Security.Cryptography.ICryptoTransform]$descryptAlgorithm.CreateDecryptor()
$dataToDecrypt = $encryptedData
$decryptorMemoryStream = new-Object IO.MemoryStream #(,$dataToDecrypt)
$decryptorCryptoStream = new-Object Security.Cryptography.CryptoStream $decryptorMemoryStream,$decryptor,"Read"
$streamReader = new-Object IO.StreamReader $decryptorCryptoStream
try
{
Write-Output $streamReader.ReadToEnd()
}
catch
{
$e = $_.Exception
$msg = $e.Message
while ($e.InnerException) {
$e = $e.InnerException
$msg += "`n" + $e.Message
}
$msg
}
Let's look at some examples that trigger the padding exception.
Failing to flush the final block
This blog post has a good write up of this scenario.
#$encryptorCryptoStream.FlushFinalBlock();
Invalid keys
I've changed the byte array used for the decryption key slightly here to simulate keys that don't match.
$descryptAlgorithm.Key = #(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 17)
RijndaelManaged with an empty input
$descryptAlgorithm = [System.Security.Cryptography.SymmetricAlgorithm] (New-Object System.Security.Cryptography.RijndaelManaged)
// ...
$dataToDecrypt = #()
Invalid padding
I've manually added some invalid padding to the end of the data to decrypt.
$dataToDecrypt = $encryptedData + #(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16)
Different padding schemes
Interestingly only some padding scheme combinations result in the padding error. A lot will decrypt without error, even if the resulting sting is incorrect.
$descryptAlgorithm.Padding = [System.Security.Cryptography.PaddingMode]::ANSIX923
Different block sizes
$descryptAlgorithm.BlockSize = 64