Fix GCM bug: would accept AD without keyed if AD was empty

1 files changed, 2 insertions, 2 deletions

diff --git a/src/lib/modes/aead/gcm/ghash.cpp b/src/lib/modes/aead/gcm/ghash.cpp
index 763879ce4..1d1e68e1c 100644
--- a/src/lib/modes/aead/gcm/ghash.cpp
+++ b/src/lib/modes/aead/gcm/ghash.cpp
@@ -49,8 +49,6 @@ void GHASH::gcm_multiply(secure_vector<uint8_t>& x,
                          const uint8_t input[],
                          size_t blocks)
    {
-   verify_key_set(m_HM.size());
-
 #if defined(BOTAN_HAS_GCM_CLMUL)
    if(CPUID::has_clmul())
       {
@@ -113,6 +111,8 @@ void GHASH::gcm_multiply(secure_vector<uint8_t>& x,
 void GHASH::ghash_update(secure_vector<uint8_t>& ghash,
                          const uint8_t input[], size_t length)
    {
+   verify_key_set(m_HM.size());
+
    /*
    This assumes if less than block size input then we're just on the
    final block and should pad with zeros