Warning for libgmp < 5 is unclear

[Toshio Kuratomi]

Fedora EPEL builds addon packages for RHEL. One package that is shipped is a forwards compat version of pycrypto-2.6.1. For RHEL6, RHEL is shipping with libgmp-5.x. This triggers the following warning from pycrpyto:

- _warn("Not using mpz_powm_sec. You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.", PowmInsecureWarning)

People using the library encounter this error and are concerned that pycrypto is insecure. However, reading the pycrypto code it seems that what's actually happening is that pycrypto detects the timing-attack-vulnerable version and then fallsback to a pure-python implementation that is not vulnerable. If this is the case, the warning message should be changed so that people are not mislead into thinking that pycrypto is insecure.

Patch with updated message is attached.

If my analysis of the code is incorrect and the pure-python version of the code being used when gmp < 5, please let us know so that we can figure out a solution. Thanks.

(EPEL Bug report: https://bugzilla.redhat.com/show_bug.cgi?id=1103566 )