We looked at the OpenSSL implementation, it also bails immediately.


On Tue, Oct 29, 2013 at 11:58 AM, Alex Stapleton
<notifications@github.com>wrote:

> In cryptography/hazmat/primitives/padding.py:
>
> > +        return result
> > +
> > +    def finalize(self):
> > +        if self._buffer is None:
> > +            raise ValueError("Context was already finalized")
> > +
> > +        if not self._buffer:
> > +            raise ValueError("Invalid padding bytes")
> > +
> > +        pad_size = six.indexbytes(self._buffer, -1)
> > +
> > +        if pad_size > self.block_size // 8:
> > +            raise ValueError("Invalid padding bytes")
> > +
> > +        for b in six.iterbytes(self._buffer[-pad_size:]):
> > +            if b != pad_size:
>
> raising early like this leads to a timing side-channel in the padding
> validation?
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/pyca/cryptography/pull/192/files#r7290507>
> .
>



-- 
"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: 125F 5C67 DFE9 4084