[dns-privacy] Spencer Dawkins' Yes on draft-ietf-dprive-edns0-padding-02: (with COMMENT)

["Spencer Dawkins" <[e-mail]>]

Spencer Dawkins has entered the following ballot position for
draft-ietf-dprive-edns0-padding-02: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dprive-edns0-padding/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for producing this draft. I do have one question about this text:

   The PADDING octets SHOULD be set to 0x00.  Other values MAY be used;
   for example, in cases where there is a concern that the padded
   message could be subject to compression before encryption.  PADDING
   octets of any value MUST be accepted in messages received.

I'm not entirely sure I understand the point of "SHOULD be set to 0x00".
I'm not questioning the SHOULD (you explain why choosing another value
would be a good idea, thank you ), but I'm wondering why there's a
normative requirement at all. 

I was trying to guess, and one hypothesis was that if the padding is
consistently 0x00, it's less likely to provide a covert channel (or at
least you'd be more likely to notice packets using different padding),
but the security considerations section didn't mention that, so I'm still
lost.

If there's a reason to zero the padding bytes in the uncompressed case, a
sentence of explanation might be useful.