Add a warning about Decrypt() being used as a padding oracle.

Add a warning about Decrypt() being used as a padding oracle.

R=agl@chromium.org,rsleevi@chromium.org
BUG=124434
TEST=none
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=133822

[wtc, 2012-04-24 22:21:12]

I took a shot at writing a comment.  I am not sure if it makes
a lot of sense to someone unfamiliar with crypto.  Please
make sure it is accurate to people working in this field.

Re: AGL's suggestion of changing Decrypt() to return void:
the difficulty is what to return in the 'plaintext' output
argument when the decryption fails.  Returning a fixed
pattern (such as all 0s), a random pattern, or the ciphertext
itself can all be used to deduce that decryption failed.

[agl, 2012-04-24 22:27:48]

LGTM

https://chromiumcodereview.appspot.com/10216004/diff/1/crypto/encryptor.h
File crypto/encryptor.h (right):

https://chromiumcodereview.appspot.com/10216004/diff/1/crypto/encryptor.h#new...
crypto/encryptor.h:80: // be used as a padding oracle.
...a padding oracle to attack the cryptosystem.

(I might be unclear, to a non-crypto person, that a padding oracle is bad.)

[Ryan Sleevi, 2012-04-24 22:28:22]

lgtm

[commit-bot: I haz the power, 2012-04-24 23:10:02]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/wtc@chromium.org/10216004/4

[commit-bot: I haz the power, 2012-04-24 23:50:29]

Try job failure for 10216004-4 (retry) on win_rel for step "compile" (clobber
build).
It's a second try, previously, step "compile" failed.
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=win_rel&nu...