phalcon/cphalcon · error · InvalidPaddingSize

Padding size cannot be less than 0 or greater than 256

Error message

Padding size cannot be less than 0 or greater than 256

What it means

In CBC mode Crypt::encryptGetPadded() computes paddingSize = blockSize - (strlen(input) % blockSize) and requires it to stay within 0..255; otherwise it throws InvalidPaddingSize. With mainstream ciphers (AES blockSize 16) paddingSize is always 1..16, so in practice this error indicates an exotic cipher whose block size is 256+ or a degenerate blockSize of 0 from an unexpected cipher configuration.

Source

Thrown at phalcon/Encryption/Crypt.zep:694

     * @return string
     * @throws Exception
     */
    protected function cryptPadText(
        string input,
        string mode,
        int blockSize,
        int paddingType
    ) -> string {
        var padding, paddingSize, service;

        let padding     = "",
            paddingSize = 0;

        if true === this->checkIsMode(["cbc"], mode) {
            let paddingSize = blockSize - (strlen(input) % blockSize);

            if paddingSize >= 256 || paddingSize < 0 {
                throw new InvalidPaddingSize();
            }

            let service = this->padFactory->padNumberToService(paddingType),
                padding = this->padFactory->newInstance(service)
                                          ->pad(paddingSize);
        }

        if 0 === paddingSize {
            return input;
        }

        return input . substr(padding, 0, paddingSize);
    }

    /**
     * Removes a padding from a text.
     *
     * If the function detects that the text was not padded, it will return it

View on GitHub (pinned to b7419de9cd)

Solutions

1. Switch to a standard cipher such as aes-256-cbc or aes-128-cbc where blockSize is 16 and the pad is always 1..16.
2. Verify what OpenSSL reports for the cipher: php -r '$m = openssl_get_cipher_methods(true); ...' and check the cipher is mainstream.
3. If you truly need the exotic cipher, pre-pad the input yourself so the computed paddingSize falls in range is NOT supported by this API - use a lower-level openssl_encrypt call instead.

Example fix

// before
$crypt->setCipher('des3-cbc-weird-variant');
$crypt->encrypt($data); // block size anomaly -> InvalidPaddingSize

// after
$crypt->setCipher('aes-256-cbc');
$crypt->encrypt($data);

// With cbc mode, ensure the computed pad would be in range before encrypting:
$blockSize = 16; // AES
$paddingSize = $blockSize - (strlen($data) % $blockSize);
if ($paddingSize >= 256 || $paddingSize < 0) {
    throw new \RuntimeException('Cipher/padding combination unsupported');
}
$crypt->encrypt($data);

try {
    $cipherText = $crypt->encrypt($data);
} catch (\Phalcon\Encryption\Crypt\Exception\InvalidPaddingSize $e) {
    // exotic cipher/block-size combination - switch to a standard cipher
    $logger->error('Padding out of range - unsupported cipher configuration');
    throw $e;
}

When it happens

Trigger: Calling encrypt() with 'cbc' mode on a cipher whose block size pushes the computed pad beyond 255 (e.g., certain non-standard/legacy algorithms), or an OpenSSL build reporting an anomalous block size for the configured cipher. Not reachable with aes-*-cbc under normal conditions.

Common situations: Nearly always an indirect symptom of an unusual setCipher() choice on an odd OpenSSL build; effectively a defensive guard rather than an error users are expected to hit with AES.

Related errors

• Decryption key cannot be empty
• The provided input is too short for the selected cipher.
• Hash does not match.
• Encryption key cannot be empty
• Cannot calculate Random Pseudo Bytes

AI-assisted analysis of phalcon/cphalcon@b7419de9cd (2026-08-21). Data as JSON: /api/errors/20fb817da44e03e4. Report an issue: GitHub.