dlitz/pycrypto — pull request #111 by abadger (2014-12-31 02:43:07+00:00)
Title: Clarify warning for old gmp

Fedora EPEL builds addon packages for RHEL. One package that is shipped is a forwards compat version of pycrypto-2.6.1 for RHEL6. RHEL6 is shipping with libgmp-4.x. This triggers the following warning from pycrpyto:
``` python
_warn("Not using mpz_powm_sec. You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)
```

People using the library encounter this error and are concerned that pycrypto is insecure. However, reading the pycrypto code it seems that what's actually happening is that pycrypto detects the timing-attack-vulnerable version and then fallsback to a pure-python implementation that is not vulnerable. If this is the case, the warning message should be changed so that people are not mislead into thinking that pycrypto is insecure.

This pull request implements a change to the warning message.

If my analysis of the code is incorrect and the pure-python version of the code being used when gmp < 5 is insecure, please let us know so that we can figure out a solution. Thanks.

(EPEL Bug report: https://bugzilla.redhat.com/show_bug.cgi?id=1103566 )