Okey doke.


On Tue, Oct 29, 2013 at 9:15 PM, Paul Kehrer <notifications@github.com>wrote:

> In cryptography/hazmat/bindings/openssl/backend.py:
>
> >          res = self._backend.lib.EVP_CipherInit_ex(ctx, evp_cipher,
> >                                                    self._backend.ffi.NULL,
> > -                                                  cipher.key, iv_nonce,
> > +                                                  self._backend.ffi.NULL,
> > +                                                  self._backend.ffi.NULL,
> > +                                                  operation)
> > +        assert res != 0
> > +        # set the key length to handle variable key ciphers
> > +        res = self._backend.lib.EVP_CIPHER_CTX_set_key_length(
> > +            ctx, len(cipher.key)
> > +        )
>
> Correct, the OpenSSL API requires that you init the context without the
> key or IV, set the key length, then add the key/IV (but don't pass the
> EVP_CIPHER).
>
> This is also how you have to do it when using EVP_CIPHER_CTX_ctrl for
> AEAD stuff.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/pyca/cryptography/pull/196/files#r7302341>
> .
>



-- 
"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: 125F 5C67 DFE9 4084