Is it okay to bail out early when length mismatch is detected?
Specifically, when verifying authenticated encryption, is it okay to bail out early if the wrong amount of ciphertext or the wrong amount of associated data is given?
As I understand it, these two are generally public quantities, and so this does not result in a timing attack.