mverleg
commented
3 years ago The draft-implementation currently pads the plain text, then compresses and encrypts it.
- This is possibly more secure (i.e. if the random number generator has a recognizable pattern).
- It is definitely much easier, because otherwise the code must be rewritten to encrypt the private header separately (and in such a way that the header length is not revealed).
- But it is rather wasteful to spend several encryption cycles and compression on random garbage.
- Also it might be preferable to pad the final size to a power of two, instead of plain size, since random data is very incompressible while some plain data is, leading to size being guessable.
Compression already hides size a bit, but optionally also pad to some specific points (powers of two?) to hide more (at the cost of disk space). See also #12.