Re: [openpgp] Padding packets

[Daniel Huigens <[e-mail]>]

Hi Neal,

> One issue I see with this type of deterministic padding is that if a
> message or archive contains multiple padding packets, then it will be
> compressible. That will not be the case if we bind the padding to the
> preceding packet.

As currently specified, I think a message can't contain multiple padding
packets; and in a message archive, the padding packets will be inside
the encrypted data packet, so they should still be incompressible.
However, I could see in the case of a keyring (e.g. returning multiple
keys from WKD), it might be useful to have a padding packet in each key,
though we could also argue that the server should just append only one
padding packet at the very end.

If we do care about multiple padding packets, maybe rather than binding
it to the previous packet, providing a random key would be sufficient?
For example, we could specify that the packet contains 16 random bytes,
followed by a AES-CTR encryption using that key.

(I'm not a fan of having to hash the preceding packet, because when
stream-decrypting, you don't know in advance if there will be a padding
packet, and the preceding packet in that case could be the literal data
packet which is potentially very large.)

Best,
Daniel