> don't imply more precision in your internal data representation than was present in your data source Matrix's e2ee message formats have a form of this issue.

> don't imply more precision in your internal data representation than was present in your data source Matrix's e2ee message formats have a form of this issue. The AES IVs generated are only a subset of the possible IV space than the cryptography actually uses. This gets expressed in the JSON base64 string storing the IV always having an AAAAA prefix for the zero-padding. I'm not sure if this is still true and I don't believe it was responsible for any security vulnerability due to how the IVs are used, but it's still a sloppy design.