I believe I have it worked out now...after reading the "File Formats used
by 2.x" document, 2313 and 2437, does the m value look like this?:
m = 0x00 0x02 (random non zero data - 8 bytes minimum) 0x00 0x0A (session
key) (checksum)
The 0x0A represents the Twofish algorithm.
that's reflects my current understanding.
Yes, I believe this is correct.
to all:
i've been curious about the length of the random padding octets. i
presume none of them are allowed to 0x00 (that's what non-zero data
means, may be?) and thus the 0x00 value preceding the
algorithm-specifying octect can serve as a "marker" to indicate where
the random padding ends. is that correct?
Yes.