<head></head><body><div>There is little written about termination, in 12. Application responsibilities:</div><div><br></div>> Termination: Applications must consider that a sequence of Noise transport messages could be truncated by an attacker. Applications should include explicit length fields or termination signals inside of transport payloads to signal the end of a stream of transport messages.<div><div><br></div><div>and then in the following section:</div><div><br></div>> Termination: Preventing attackers from truncating a stream of transport messages is an application responsibility. See previous section.</div><div><br></div><div>It sounds odd to me that the application running on top of Noise should be preoccupied by network attacks (such as termination here). What's the recommendation on how to do that? I'm not sure how protobuf works but if it's a TLV-based encoding it should have a total length up from the start. What about JSON-based messages? Should it include a length field right from the start as well?</div><div><br></div><div>Regards,</div><div>David</div></body>