diff options
| author | Alex Gaynor <alex.gaynor@gmail.com> | 2013-12-21 17:29:02 -0800 |
|---|---|---|
| committer | Alex Gaynor <alex.gaynor@gmail.com> | 2013-12-21 17:29:02 -0800 |
| commit | 8eda240d0e055e16c26021de2624eb7fab1ccb47 (patch) | |
| tree | 9cf1f4c95e35b3e4191cb85667c1d83af6909098 /cryptography | |
| parent | 9b7624e3cd4d19cae38bc8f05eea7b6164445453 (diff) | |
| parent | 048d6cb43a0757f3b4cca385e788d30173ebcb17 (diff) | |
| download | cryptography-8eda240d0e055e16c26021de2624eb7fab1ccb47.tar.gz cryptography-8eda240d0e055e16c26021de2624eb7fab1ccb47.tar.bz2 cryptography-8eda240d0e055e16c26021de2624eb7fab1ccb47.zip | |
Merge pull request #327 from reaperhulk/gcm-lower-limit-tag
Restrict GCM tag length to 4+ bytes
Diffstat (limited to 'cryptography')
| -rw-r--r-- | cryptography/hazmat/backends/openssl/backend.py | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/cryptography/hazmat/backends/openssl/backend.py b/cryptography/hazmat/backends/openssl/backend.py index b9e8b896..bd3eee20 100644 --- a/cryptography/hazmat/backends/openssl/backend.py +++ b/cryptography/hazmat/backends/openssl/backend.py @@ -319,9 +319,9 @@ class _CipherContext(object): ) assert res != 0 if operation == self._DECRYPT: - if not mode.tag: - raise ValueError("Authentication tag must be supplied " - "when decrypting") + if not mode.tag or len(mode.tag) < 4: + raise ValueError("Authentication tag must be provided and " + "be 4 bytes or longer when decrypting") res = self._backend.lib.EVP_CIPHER_CTX_ctrl( ctx, self._backend.lib.Cryptography_EVP_CTRL_GCM_SET_TAG, len(mode.tag), mode.tag |