[tptacek]

All they need is distinguishable errors when decrypts fail. The contents of the error are irrelevant. You can send a bare 500 with no content and still be trivially vulnerable to this attack.

[bradhe]

Fair enough, I guess I didn't understand the attack thoroughly.