TAP Hybrid Encryption case 1 is used when the payload is equal to the maximum length
The spec says:
- 1. If M is less than PK_ENC_LEN-PK_PAD_LEN, pad and encrypt M with PK.
+ 1. If M is less than or equal to PK_ENC_LEN-PK_PAD_LEN, pad and encrypt M with PK.
https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt#n117
(We'll need to fix the line wrapping here as well.)
But the code does:
if (!force && fromlen+overhead <= pkeylen) {
https://gitweb.torproject.org/tor.git/tree/src/common/crypto.c#n1262