[Bug 27603] verify() can fail either by returning flase or rejecting with an error, inconsistent which is used

https://www.w3.org/Bugs/Public/show_bug.cgi?id=27603

jimsch <ietf@augustcellars.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ietf@augustcellars.com

--- Comment #2 from jimsch <ietf@augustcellars.com> ---
I have been going through the list of things that I would consider to be both
an operational error and would not be considered to be a security error.  For
example, one could conceivably make the fact that after the decryption is done
the structure of the internal data is incorrect is an operation error, but this
is a known security attack and should return as a signature validate failure
(i.e boolean=false).

NotSupported is correct for an error of not supporting an operation.  The only
thing that I can think of that would lead to an OperationError would be a
transient error where a hardware failure occurred or similar condition.

I would recommend that we just remove the step dealing with OperationError
entirely.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

Received on Friday, 4 March 2016 01:56:09 UTC