Incomplete output is incorrect output: truncate it to zero

[hakavlad]

For decryption, if authentication fails, the file key SHOULD be zeroed and an error MUST be thrown, causing decryption of the file to stop.

Propose truncating the incomplete output file to 0 on authentication failure — this prevents accidental use of a corrupted (incomplete) file. I believe this is a stricter and more correct way to handle an authentication failure.

[samuel-lucas6]

I'm not sure where you've taken that quote from because the current specification page says the following:

For decryption, if authentication fails at any point, decryption MUST stop, the file key SHOULD be zeroed, and the plaintext output file SHOULD be deleted.

SHOULD could be changed to MUST. I'm not sure what motivated that originally.

[hakavlad]

I'm not sure where you've taken that quote

At the end of https://www.kryptor.co.uk/specification#file-metadata-header section. I made a conclusion based on this part of the specification without reading it to the end. I suggest removing the duplication—how authentication errors are handled. This is mentioned twice in the specification.

[samuel-lucas6]

Ah sorry, I see what you mean. I believe it was done this way because no decryption of the file content has happened at this point, so there's nothing to truncate/delete. In other words, the behaviour is different depending of if it's the header or the actual file.