Note payload uniformity via padding and ellswift

bitcoin · DanGould · Jun 3, 2023 · Aug 12, 2023 · Nov 1, 2023 · Dec 14, 2023
commit 73941ab3d16b2f432ac25c7c6cbe11790cfb60b9
diff --git a/bip-0077.mediawiki b/bip-0077.mediawiki
@@ -238,9 +238,16 @@ OHTTP relays can be run as basic HTTP proxies from wallet providers or third par
 <img src=bip-0077/oblivious-http-sequence.png></img>
 
 
-===Message Padding===
+===Uniform Payloads===
+
+Encapsulated OHTTP payloads and messages seen by the Payjoin Directory are constructed to be uniform so that the third-party services are unable to distinguish between them based on payload size or by distinguishing them from random bytes. However, the Encapsulated OHTTP message includes an uncompressed key for the DHKEM which is distinguishable from random bytes but uniform across different encapsulated requests.
+
+OHTTP messages are padded to 8192 bytes.
+
+HPKE message payloads are padded to 7168 bytes. Elligator swift is used to encode encapsulated HPKE public keys prepended to the HPKE ciphertext so that the payjoin directory can't distinguish between key material, the ciphertext, and randomness, so that the directory may accomodate new protocols in the future without discrimination.
+
+This is sufficient size for most PSBTs without exceeding the [[https://www.geekersdigest.com/max-http-request-header-size-server-comparison/| 8KB limit]] of many HTTP/1.1 web servers. 8KB is also too small for image sharing, making misuse of the Payjoin Directory impractical.
 
-All ciphertexts should be padded to the same length of 7168 bytes to prevent traffic analysis. This is sufficient size for most PSBTs without exceeding the [[https://www.geekersdigest.com/max-http-request-header-size-server-comparison/| 8KB limit]] of many HTTP/1.1 web servers. 8KB is also too small for image sharing, making misuse of the Payjoin Directory impractical.
 
 ===Secp256k1 Hybrid Public Key Encryption===