There's no specific error code used? :(


On Fri, Nov 22, 2013 at 11:25 AM, Paul Kehrer <notifications@github.com>wrote:

> In tests/hazmat/primitives/utils.py:
>
> > +        pytest.skip(skip_message)
> > +    if params.get("pt") is not None:
> > +        plaintext = params.pop("pt")
> > +    ciphertext = params.pop("ct")
> > +    aad = params.pop("aad")
> > +    if params.get("fail") is True:
> > +        cipher = Cipher(
> > +            cipher_factory(binascii.unhexlify(params["key"])),
> > +            mode_factory(binascii.unhexlify(params["iv"]),
> > +                         binascii.unhexlify(params["tag"])),
> > +            backend
> > +        )
> > +        decryptor = cipher.decryptor()
> > +        decryptor.add_data(binascii.unhexlify(aad))
> > +        actual_plaintext = decryptor.update(binascii.unhexlify(ciphertext))
> > +        with pytest.raises(AssertionError):
>
> Yeah this is one of the big outstanding issues for this. OpenSSL handles
> tag verification errors during decryption by returning 0 from
> EVP_CipherFinal_ex, but this is what it returns for any error. To get more
> detail you would normally call ERR_get_error() to obtain the unsigned long
> error code and then ERR_reason_error_string to get the associated error
> string, but tag verification failures don't appear to provide additional
> error data.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/pyca/cryptography/pull/176/files#r7866120>
> .
>



-- 
"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: 125F 5C67 DFE9 4084