17.5 Record padding
The TLS 1.3 specification allows Alice and Bob to pad their TLS records by increasing TLSCiphertext’s size in order to hide the size of the actual data from Eve.
While this may seem odd at first because the data sent is encrypted, if Eve can determine the size of the encrypted data, she can perform traffic analysis. Traffic analysis is one of the oldest attacks on communication and refers to the process of intercepting and examining encrypted messages sent by Alice and Bob in order to deduce information from the size, frequency, or other observable attributes of the encrypted communication. In other words, with traffic analysis Eve can determine communication patterns such as who is talking to whom, how much, how often, and when. Very often, these patterns can be more valuable than the content of the communication itself.
Traffic analysis has its roots in military intelligence. More precisely, it’s a technique employed in the branch of signal intelligence...
