Wishlist / reminders for a new protocol format

[felixfontein]

This issue is to keep track of things that should be changed / improved when we want to update SOPS's encrypted file format.

• MAC:

  • Do not ignore null values: https://github.com/getsops/sops/issues/828
  • Include keys in MAC computation to avoid problem described in https://github.com/getsops/sops/issues/52#issuecomment-2566569931

• Encrypted data:

  • Add padding to not fully reveal the length of the clear text data (https://github.com/getsops/sops/issues/815)
  • Eventually even encrypt null: https://github.com/getsops/sops/issues/828#issuecomment-796132557
  • Use protobuf instead of own format: https://github.com/getsops/sops/issues/815#issuecomment-785158790

[felixfontein]

Round-trip safe presentation of data, like getting back 1.10, 0x1_5, etc. after decryption when that was the input value. There's always the question of how far this can and should go, like preserving other YAML properties (tags, flow style, whether strings use quoting, what kind of quoting, multiline string representation, etc.).

Ref: https://github.com/getsops/sops/issues/1616#issuecomment-2661431076