3 ms·
You're right, and it's by-the-by; I missed that decrypt() had moved on to CTR in that code. If it had been CBC with ISO7816 or PKCS#5 padding then I do think t
by ctz 13y ago
You're right, and it's by-the-by; I missed that decrypt() had moved on to CTR in that code.
If it had been CBC with ISO7816 or PKCS#5 padding then I do think this would be attackable. The unpadding errors from decrypt trump the MAC error thanks to the "err == nil && !match" expression.
- tptacek 13y agoFortunately, it's not giving a distinctive error, and always runs both the MAC and the decryption so timing won't distinguish, either. The big problem with this pattern is how disastrous it is in every other language (coupled with the lack of any rationale for decrypting on MAC failure).