Please add a comment.


On Sun, Jan 19, 2014 at 10:42 PM, Paul Kehrer <notifications@github.com>wrote:

> In cryptography/hazmat/backends/commoncrypto/backend.py:
>
> > +class _CipherContext(object):
> > +    _ENCRYPT = 0  # kCCEncrypt
> > +    _DECRYPT = 1  # kCCDecrypt
> > +
> > +    def __init__(self, backend, cipher, mode, operation):
> > +        self._backend = backend
> > +        self._cipher = cipher
> > +        self._mode = mode
> > +        self._operation = operation
> > +        # bytes_processed is needed to work around rdar://15589470, a bug where
> > +        # kCCAlignmentError fails to raise when supplying non-block-aligned
> > +        # data.
> > +        self._bytes_processed = 0
> > +        if (isinstance(cipher, interfaces.BlockCipherAlgorithm) and not
> > +                isinstance(mode, (OFB, CFB, CTR))):
> > +            self._byte_block_size = cipher.block_size // 8
>
> There is a bug in CommonCrypto where block ciphers do not raise
> kCCAlignmentError when finalizing if you supply non-block aligned data. To
> work around this we need to keep track of the block alignment ourselves,
> but only for alg+mode combos that require block alignment. OFB, CFB, and
> CTR make a block cipher algorithm into a stream cipher so we don't need to
> track them (and thus their block size is effectively 1 byte just like
> OpenSSL/CommonCrypto treat RC4 and other stream cipher block sizes).
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/pyca/cryptography/pull/486/files#r8996540>
> .
>



-- 
"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: 125F 5C67 DFE9 4084