Merge pull request #778 from libtom/pr/eax-taglen

EAX properly handle taglen boundaries

Author: sjaeckel

doc/crypt.tex

@@ -1867,6 +1867,10 @@ \chapter{Authenticated Encryption}
 The only difference is eax\_decrypt\_verify\_memory() does not emit a tag.  Instead you pass it a tag as input and it compares it against
 the tag it computed while decrypting the message.  If the tags match then it stores a $1$ in \textit{res}, otherwise it stores a $0$.
 
+The length of the tag is a security parameter of EAX mode: tags may be truncated and a zerolength tag is legal -- it simply
+provides no authenticity, which is the caller's choice.  A \textit{taglen} larger than the block size of the used cipher is rejected
+by eax\_decrypt\_verify\_memory() with \textbf{CRYPT\_INVALID\_ARG} (encrypt side can never emit such a tag).
+
 \mysection{OCB Mode}
 \subsection{Preface}
 

src/encauth/eax/eax_decrypt_verify_memory.c

@@ -49,8 +49,13 @@ int eax_decrypt_verify_memory(int cipher,
    /* default to zero */
    *stat = 0;
 
-   /* limit taglen */
-   taglen = MIN(taglen, MAXBLOCKSIZE);
+   if ((err = cipher_is_valid(cipher)) != CRYPT_OK) {
+      return err;
+   }
+   /* NOTE: zero-length tag is legal (it just provides no authenticity) */
+   if (taglen > (unsigned long)cipher_descriptor[cipher].block_length) {
+      return CRYPT_INVALID_ARG;
+   }
 
    /* allocate ram */
    buf = XMALLOC(taglen);