Remove padding (CBC) from decrypted text I have a bit problem with padding. Everything goes fine when I encrypt the text BUT when I decrypt I see some extra characters. Sometime's one character sometimes more and I dont know how to remove them.

But one question I am really upset with is that why does padding show in my decrypted text BUT now others?

Here's my code (PHP) to generate IV:

if($iv = openssl_random_pseudo_bytes(32)){
        $final_iv = substr(base64_encode($iv), 0, 32);
    //The IV size should be 32 characters
}


Here's example of the paddings:

E¢9Àšæ—–Í

Qcn«ûØ›§Ñ¼waf—®

º„%¬â;¸*Í”¨Ö
First, you have to know what padding you are using. In the padding, you will find the padding length.

Second, you should set the padding type in the library.

Third, removing and validating and using padding is tricky and can lead to some padding oracle attacks. In essential, the attacker modifies a block, which is likely to result in wrong padding and a wrong message, but it might also result in a correct message. Attacker then observes if the message was accepted or not and makes some deduction.

To mitigate the padding oracle attack, the easiest way is using encrypt-then-MAC. As a result, any modified message is rejected and attacker can't observe differences between two garbled messages. (Probability of accepting a garbled message is negligible.)

These padding oracle attacks aren't theoretical. For example, SSL3 was killed by one of padding oracle attacks, i.e. POODLE.