HMAC can securely validate if a MAC is correct.

In the current implementation, it is left up to the caller
to assess if the locally computed MAC matches the MAC associated
to the received message.

However, the most natural way to do that (use == operator)
is also deepy unsecure, see here:

http://seb.dbzteam.org/crypto/python-oauth-timing-hmac.pdf

With this patch, the new HMAC.verify() method accepts
the given MAC and perform the check on behalf of the caller.
The method will use constant-time code (still dependent on the length
of the MAC, but not on the actual content).
Add MacMismatchError exception.

When verify() detects that the MAC is incorrect,
it will issue a user-defined MacMismatchError exception
and not the standard ValueError mismatch.
MAC unit tests become independent of hashes

The MAC unit tests assume that the MAC algorithm is
based on hash functions (HMAC).
Additionally, a single test vector is quite complex
in that it includes result for multiple tests (each
performed on the same data, but with different
hashes).

This patch simplifies the MAC unit test so that it does
not depend on hashes and a test vector is simply made up by:
* 1 input
* 1 result
* All parameters to pass to the new() function
Add support for CMAC

This patch adds support for CMAC (RFC4493, NIST SP800-38B).
Merge CCM and new MACs branches
Add EAX authenticated encryption mode
Add support for SIV (Synthetic IV) mode

This patch add supports for SIV, an AEAD block cipher
mode defined in RFC5297. SIV is only valid for AES.

The PRF of SIV (S2V) is factored out in the Protocol.KDF module.

See the following example to get a feeling of the API (slightly
different than other AEAD mode, during decryption).

Encryption (Python 2):

	>>> from Crypto.Cipher import AES
	>>> key = b'0'*32
	>>> siv = AES.new(key, AES.MODE_SIV)
	>>> ct  = siv.encrypt(b'Message')
	>>> mac = siv.digest()

Decryption (Python 2):

	>>> from Crypto.Cipher import AES, MacMismatchError
	>>> key = b'0'*32
	>>> siv = AES.new(key, AES.MODE_SIV)
	>>> pt  = siv.decrypt(ct + mac)
	>>> try:
	>>>	siv.verify(mac)
	>>>	print "Plaintext", pt
	>>> except MacMismatchError:
	>>> 	print "Error"
Add CTR mode benchmark
Add support for GCM mode (AES only).

The main change done by this commit is adding support
for MODE_GCM (NIST SP 800 38D). Test vectors are included.

The mode uses a C extension (Crypto.Util.galois._ghash)
to compute the GHASH step. The C implementation is the most
basic one and it is still significantly (5x times) slower than CTR.
Optimizations can be introduced using tables (CPU/memory trade-off)
or even AES NI instructions on newer x86 CPUs.

This patch also simplifies Crypto.Cipher.blockalgo.py by:
 * removing duplicated code previously shared by digest() and verify().
 * removing duplicated code previously shared by Crypto.Hash.CMAC
   and Crypto.Cipher.block_algo (management of internal buffers
   for MACs that can only operate on block aligned data, like
   CMAC, CBCMAC, and now also GHASH).
Add key setup speed benchmark for all AEAD modes.
Optimize GCM speed with pre-computed tables.

Tables take 64KByte per each key.

Encryption performance is more than doubled
(29 MBps vs 8MBps for AES128).

As a drawback, key setup is much slower (1300 key/s
on the same machine).
Optimize key setup for GCM mode.

GCM mode requires GHASH for 2 different operations: one for
the data (AD + ciphertext) and one for the IV.

Construction of tables to speed-up GHASH is very expensive
and it is worth doing only for the data, not for the IV.

This patch ensures that the GHASH for the IV does not
use tables, with a ~40% faster key setup.
Added get_mac_state() for GCM and EAX modes

This method is useful when one has to encrypt or decrypt multiple
messages:

- that all share the first part of the header, and that part is
  very large
- with the same key (but different IV)
- with GCM or EAX modes

An optimization consists in authenticating the first part of
the header only once, and then reuse the intermediate data
(that is, the MAC state) across all other messages.
Made blockalgo.py more PEP8-compliant.