From 7eb7163cec4439fa274afe336c5825f669a3a15f Mon Sep 17 00:00:00 2001 From: Richard Barnes Date: Mon, 4 Dec 2023 13:18:40 -0500 Subject: [PATCH] Update draft-ietf-sframe-enc.md Co-authored-by: Brendan McMillion --- draft-ietf-sframe-enc.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/draft-ietf-sframe-enc.md b/draft-ietf-sframe-enc.md index c9c4b93..c06d664 100644 --- a/draft-ietf-sframe-enc.md +++ b/draft-ietf-sframe-enc.md @@ -524,7 +524,9 @@ def decrypt(metadata, sframe_ciphertext): If a ciphertext fails to decrypt because there is no key available for the KID in the SFrame header, the client MAY buffer the ciphertext and retry decryption once a key with that KID is received. If a ciphertext fails to decrypt for any -other reason, the client MUST discard the ciphertext. +other reason, the client MUST discard the ciphertext. Invalid ciphertexts SHOULD be +discarded in a way that is indistinguishable (to an external observer) from having +processed a valid ciphertext. ## Cipher Suites