Re: [openpgp] Padding packets

[Daniel Huigens <[e-mail]>]

On Monday, June 20th, 2022 at 20:40, Daniel Kahn Gillmor wrote:

> - [...] a padding packet might cause a rejection if both
> implementations don't agree on how it was calculated, and

I somewhat agree. However, I think the proposed calculation is quite
simple (and in fact constant, so it can essentially be tested by a
single test case) so the risk of this is not very high. Having to hash
the previous packet does complicate it a lot though, imo.

> - risk multiple padding-packets being visible in the case of a
> compression routine wrapping the data (whether at the OpenPGP layer
> or outside of it.

To be perfectly honest, I think the protection against compression is
somewhat dubious, in general. If I pad a message and *then* compress,
there may still be length differences due to differences in the
message, so the protection the padding is meant to offer is reduced,
or even removed.

So - personally, I would also not be entirely opposed to setting the
padding to all zeros, and saying that if length protection is desired,
compression must not be used. In an encrypted message, the OpenPGP
implementation obviously has control over this itself; and in the case
of WKD the server also has control over this.

Best,
Daniel