title: Making AES decryption fail if invalid password
body: <p>I've written my own encryption method using AES in a project I've been working on lately using PyCrypto. I use a hash to generate a 32-byte password and feed that to AES-256bit encryption using CBC. The file input is padding using PKCS#7 padding to conform to be divisible by 16.</p>
  
  <p>I can encrypt and decrypt the file without incident and the input file originally encrypted along with the output file have the same SHA-256 hash.</p>
  
  <p>The only problem I'm finding is that if I supply the <em>wrong</em> passphrase, decryption still happens. This is a problem for what I'm doing, as I need to have decryption fail fast if the passphrase is wrong. </p>
  
  <p>How can I make this happen? I've heard of other methods of AES encryption, but it seems that PyCrypto only supports ECB, CBC, CFB, OFB, CTR, and OpenPGP. How can I implement cryptographically strong AES which will fail decryption without the right passphrase?</p>