rewrite CBC unpad without data-dependent branches, mitigates lucky 13 (s...

...till needed: hmac computation with constant time in both success and failure mode)