AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 23 Bitcoin

lightningd: `--message-padding` to allow users to disable padding altogether.

Public commit record

What the developer wrote

Authored by Rusty Russell

73/100 · Adequate
lightningd: `--message-padding` to allow users to disable padding altogether.

In case there are more cases we missed, this lets users disable it.

Changelog-Added: Config: `message-padding` option can be set to `false` to disable it for all peers.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit adds a new command-line/config option `--message-padding` that lets users turn off a recently added privacy feature. By default, Core Lightning now pads peer messages to the same length to hide which type of message is being sent. Some other Lightning implementations (LND variants and Eclair) reportedly reject or mis-handle those padding bytes, so this switch lets operators disable padding entirely if they run into compatibility problems. It is a workaround/configurability change, not a fix for a code vulnerability.

Recommended action

No immediate action required. Operators experiencing peer-connection or message-handling issues with LND/LNDK/Eclair nodes after the message-padding feature was introduced can set `message-padding=false` as a workaround. Security-conscious users should leave the default `true` unless interoperability issues force disabling it, because disabling padding removes a traffic-analysis mitigation.

Security signals we found

01

Adds an opt-out for a privacy feature (message-length padding)

02

Default behavior remains enabled; users must explicitly set false to disable

03

Motivated by interoperability failures with other Lightning implementations

04

No cryptographic, memory-safety, or authentication change

05

Does not patch a vulnerability; provides a compatibility escape hatch

Risk score

Why this scored 23/100

Our methodology →
Potential impact 3/30
Exploitability 2/25
Stealth signal 2/15
Affected reach 4/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.