1
$\begingroup$

OpenSSL supports TLSv1.3 record padding:

https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html

but I'm not sure if it works like I think it does. If I would choose a factor of 2 it would make the record (=packet/payload length???) twice the original size. Is that correct? If so, wouldn't random padding be better? Otherwise you could just divide the packet by 2,3,4 ... to get to the real value?

Improve this question
$\endgroup$
3
$\begingroup$

If I would choose a factor of 2 it would make the record (=packet/payload length???) twice the original size. Is that correct?

No; if you set a factor of 2, then the encrypted record size would always be even (that is, if it would have been odd, a padding byte would be added).

In general, a factor of $x$ would increase the size of the encrypted record from 0 to $x-1$ bytes.

Improve this answer
$\endgroup$
  • $\begingroup$ But the size increase would still be the same for all packets i.e. it is not random? $\endgroup$ – askingforafriend Jan 13 at 17:03
  • $\begingroup$ @askingforafriend the size increase would be the same for all packets of the same size. $\endgroup$ – SEJPM♦ Jan 13 at 18:59
  • 1
    $\begingroup$ As an example if you set RecordPadding to the maximum (16384), then all records will be 16384 no matter what the original size. If you set it to half that (8192) then all records that were originally less than 8192 will become 8192 when they are sent. Any original record longer than that well become 8192*2 in length (16384). $\endgroup$ – Matt Caswell Jan 13 at 20:35
  • 1
    $\begingroup$ Or, putting it another way, if you set RecordPadding to 100, and the adversary sees a ciphertext that's 200 bytes long, he knows (assuming he knows the RecordPadding, which is a safe assumption) that the plaintext was between 101 and 200 bytes long (but he does not know where in the range it was) $\endgroup$ – poncho Jan 13 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.