[BSI][20200807] Request Size With CWA-Fake Might Differ about cwa-verification-server HOT 2 CLOSED

Thank you @BSI-TF-CWA. The current behaviour (as of 1.2.1 of cwa verification server) is that a response padding is generated but finally not added to the payload. In future versions it will be added if the fake header flag exists i. e. the behaviour is client controlled. This is a requirement to ensure client backward compatibility.

from cwa-verification-server.

I agree with @ascheibal, we will have "old version" of the app in the wild and "new versions". New versions will send the header and support the plausible deniability feature, however older versions do not support the feature and do not sent the header. The old versions will always be susceptible to traffic analysis. For the new versions, we have to make sure that the header is always sent.
We cannot rely on all users to update their apps immediately, so for compatibility reasons the verification server must accept request without fake header for a considerable period of time.

from cwa-verification-server.