USEC Encrypt/Decrypt Question

["William B. Norton" <[e-mail]>]

The USEC spec says (bottom of page 9 rfc1910):

   The length of an octet sequence to be encrypted by the DES must be an
   integral multiple of 8.  When encrypting, the data is padded at the
   end as necessary; the actual pad value is irrelevant.

   If the length of the octet sequence to be decrypted is not an
   integral multiple of 8 octets, the processing of the octet sequence
   is halted and an appropriate exception noted.  When decrypting, the
   padding is ignored.

It sounds like we are sending the padding across the net.  Which sequence
lengths get updated?  Is the padding considered part of the PDU?  Part of
the message?

It seems we are adding complexity by sending the padding over the wire. The
agent has to do the decrypt and then figure out which bytes are exptraneous.
Wouldn't it be cleaner to do have encryptor/decryptor routines pad, crypt,
and toss the padding?  That way the PDU processing is totally uneffected by
the optional cryptography.

Bill
----------------------------------------------------------------------------
-----
William Norton			<[e-mail]>			[phone]