Module pad 

0x80-padding rules used by the secure channel.

Spec: Annex D.5

• MAC: pad input with 0x80 then zeros only if it isn’t already a multiple of 16.
• DATA encryption (SCS_17/18): pad with 0x80 then zeros, always (even when the input is already a multiple of 16).

Functions

pad_data

Append 0x80-padding for encrypted DATA (“always”).

pad_mac

Append 0x80-padding for MAC inputs (“only if needed”).

unpad_data

Strip 0x80-padding from decrypted DATA. Returns the stripped slice.