diff options
| author | Paul Kehrer <paul.l.kehrer@gmail.com> | 2021-03-21 19:14:00 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-03-21 20:14:00 -0400 |
| commit | 3005e107a83b8fc22f3d2ee2caab72351bce0d7b (patch) | |
| tree | 490a9114d2aa31b8d58e353c6bbaadf8d70eb6ce | |
| parent | 6f7a5fd9e9c133273063227e3ad80232899b4ca3 (diff) | |
| download | cryptography-3005e107a83b8fc22f3d2ee2caab72351bce0d7b.tar.gz | |
fix XTS less than one block length. fixes #5885 (#5925)
* fix XTS less than one block length. fixes #5885
* make XTS test key happy
| -rw-r--r-- | src/cryptography/hazmat/backends/openssl/ciphers.py | 8 | ||||
| -rw-r--r-- | tests/hazmat/primitives/test_aes.py | 8 |
2 files changed, 15 insertions, 1 deletions
diff --git a/src/cryptography/hazmat/backends/openssl/ciphers.py b/src/cryptography/hazmat/backends/openssl/ciphers.py index 0f96795fd..50cbeb69a 100644 --- a/src/cryptography/hazmat/backends/openssl/ciphers.py +++ b/src/cryptography/hazmat/backends/openssl/ciphers.py @@ -145,7 +145,13 @@ class _CipherContext(object): res = self._backend._lib.EVP_CipherUpdate( self._ctx, outbuf, outlen, inbuf, inlen ) - self._backend.openssl_assert(res != 0) + if res == 0 and isinstance(self._mode, modes.XTS): + raise ValueError( + "In XTS mode you must supply at least a full block in the " + "first update call. For AES this is 16 bytes." + ) + else: + self._backend.openssl_assert(res != 0) data_processed += inlen total_out += outlen[0] diff --git a/tests/hazmat/primitives/test_aes.py b/tests/hazmat/primitives/test_aes.py index 29a940463..fd37b7696 100644 --- a/tests/hazmat/primitives/test_aes.py +++ b/tests/hazmat/primitives/test_aes.py @@ -52,6 +52,14 @@ class TestAESModeXTS(object): computed_pt = dec.update(ct) + dec.finalize() assert computed_pt == pt + def test_xts_too_short(self): + key = b"thirty_two_byte_keys_are_great!!" + tweak = b"\x00" * 16 + cipher = base.Cipher(algorithms.AES(key), modes.XTS(tweak)) + enc = cipher.encryptor() + with pytest.raises(ValueError): + enc.update(b"0" * 15) + @pytest.mark.supported( only_if=lambda backend: backend.cipher_supported( |