<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_default" style="font-size:small">The ciphertext uses a more flexible tag-length-value encoding. The basic layout will be:</div><div class="gmail_default" style="font-size:small"><br class=""></div><div class="gmail_default" style="font-size:small"><stream id></div><div class="gmail_default" style="font-size:small"><stream sequence#></div><div class="gmail_default" style="font-size:small"><resend count></div><div class="gmail_default" style="font-size:small"><payload></div><div class="gmail_default" style="font-size:small"><padding></div><div class="gmail_default" style="font-size:small"><br class=""></div><div class="gmail_default" style="font-size:small">The basic idea here being that we simply fill each packet out to the max. But should this be set to all zeros or should this be randomized.</div><div class="gmail_default" style="font-size:small"><br class=""></div><div class="gmail_default" style="font-size:small">Zeros: simple, minimizes opportunity for side channel games</div><div class="gmail_default" style="font-size:small">Random: minimizes known plaintext for attacker.</div><div class="gmail_default" style="font-size:small"><br class=""></div><div class="gmail_default" style="font-size:small">If I do go with random, is there a cheap way to generate random padding I should be thinking of? I don't need this to be particularly random. </div><div class="gmail_default" style="font-size:small"><br class=""></div><div class="gmail_default" style="font-size:small">One possibility is to put the zeros through GCM with a different key. Seems wasteful though.</div></div></blockquote>Well ... any acceptable cipher today is supposed to be proof against known plaintext attacks. But a belt and suspenders approach certainly can't hurt I suppose (though if you add any kind of random padding you're opening up things like subliminal channels, which might or might not be relevant here).</div><div><br class=""></div><div>Since the goal is simply to make it hard for an attacker to know what's in this bytes, you don't need any real degree of randomness - just enough unpredictability that an attacker wouldn't gain any advantage by trying a "probably plaintext" attack using the known-plaintext assumed weakness. I'd suggest generating a single key-size random value and then just repeating it through the filler. Guessing the filler is as hard as guessing the key. If your cipher/mode is weak against repeated patterns you have other problems....</div><div><br class=""></div><div><div> -- Jerry</div><div class=""><br class=""></div></div><br class=""></body></html>