Re: Core draft last call update.

[daw%mozart.cs.berkeley.edu@localhost (David Wagner)]

Bill Sommerfeld  wrote:
>This attack has greatly increased difficulty for SSH because the SSH
>MAC also covers the random pad at the end of the message.  As a
>result, you can only tell if m and m' are identical if the random
>padding appended by the sender is identical.

Do all implementations use truly random padding?
It wasn't clear to me from the draft that the randomness
of the padding is security-critical, so I could easily imagine
as an optimization using not-very-random randomness for the
padding if I were implementing.  But maybe I missed something,
or maybe it was more obvious to others.

Would it be prudent to make the draft say that the padding
MUST use high-quality randomness, and to describe the security
threat so that implementors are less likely to fall into this trap?