I'm assuming the OpenSSL error APIs come in handy here. If not I'm going to
write a blog post about how OpenSSL is the wrost thing ever.


On Thu, Oct 24, 2013 at 9:23 PM, Paul Kehrer <notifications@github.com>wrote:

> In tests/primitives/utils.py:
>
> > +    if not only_if(backend):
> > +        pytest.skip(skip_message)
> > +    plaintext = params.get("pt")
> > +    ciphertext = params.pop("ct")
> > +    aad = params.pop("aad")
> > +    bc = BlockCipher(
> > +        cipher_factory(binascii.unhexlify(params["key"])),
> > +        mode_factory(binascii.unhexlify(params["iv"]),
> > +                     binascii.unhexlify(params["tag"])),
> > +        backend
> > +    )
> > +    decryptor = bc.decryptor()
> > +    decryptor.add_data(binascii.unhexlify(aad))
> > +    actual_plaintext = decryptor.update(binascii.unhexlify(ciphertext))
> > +    if params["fail"] is True:
> > +        with pytest.raises(AssertionError):
>
> Ah yes, this is another one of the WIP questions. OpenSSL's convention is
> that if finalizing the decrypt context returns 0 AND you're using an AEAD
> cipher then that means the tag validation has failed. Of course, there are
> quite a few other failures that also return 0 just to complicate the issue.
> Assuming I can figure out how to determine the difference between tag
> validation failure and other failures, I'd like to have it raise a
> TagValidationError at that point.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/pyca/cryptography/pull/176/files#r7208010>
> .
>



-- 
"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: 125F 5C67 DFE9 4084