the final byte of a pkcs7 padded plaintext can never be 0