Is it okay to bail out early when length mismatch is detected?

Specifically, when verifying authenticated encryption, is it okay to bail out early if the wrong amount of ciphertext or the wrong amount of associated data is given?

As I understand it, these two are generally public quantities, and so this does not result in a timing attack.

  • $\begingroup$ What is your threat model against which you want to determine if bailing out early is okay? $\endgroup$ – Cort Ammon Feb 23 '16 at 2:44
  • $\begingroup$ "Is it okay to" reveal "when length mismatch is detected?" ​ ​ $\endgroup$ – user991 Feb 23 '16 at 5:55
  • $\begingroup$ Most AEAD ciphers do not check the length, because there is no recorded length in the ciphertext $\endgroup$ – Richie Frame Feb 23 '16 at 7:10
  • $\begingroup$ Moreover: how do you know that you have the wrong length? It sounds like you have some external functionality (packet sizes?) around the outside of your AEAD system that tells you what size the content should be. As Richie says, most AEAD schemes do not require an explicit length parameter -- they work it out from the size of their inputs -- so as far as AEAD is concerned there isn't really a concept of 'length mismatch' $\endgroup$ – figlesquidge Feb 23 '16 at 10:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.