[Cryptography] Low grade randomness for padding.

[Viktor Dukhovni]

On Tue, Feb 09, 2021 at 03:40:21PM -0500, Phillip Hallam-Baker wrote:

> If I do go with random, is there a cheap way to generate random padding I
> should be thinking of? I don't need this to be particularly random.
> 
> One possibility is to put the zeros through GCM with a different key. Seems
> wasteful though.

Perhaps something like Strobe:

    https://strobe.sourceforge.io/papers/strobe-latest.pdf

might be a decent framework and may provide a natural way to do padding,
by just sampling the key stream.

As for padding with zeros or random, I'd go with zeros.  I'd be more
concerned about subliminal channels in random data than known plaintext
attacks on AES.

-- 
    Viktor.