* [PATCH proxmox-backup] pbs-key-config: ensure password-protected key is long enough
@ 2026-11-05 11:07 Fabian Grünbichler
2026-11-10 9:01 ` Christian Ebner
2026-11-11 22:36 ` applied: (subset) " Thomas Lamprecht
0 siblings, 2 replies; 4+ messages in thread
From: Fabian Grünbichler @ 2026-11-05 11:07 UTC (permalink / raw)
To: pbs-devel
while openssl fails if provided an empty slice, the resulting error message
points at the password instead of the key. checking for at least one byte of
data ensures plain and password-protected keys are distinguished.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
---
pbs-key-config/src/lib.rs | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pbs-key-config/src/lib.rs b/pbs-key-config/src/lib.rs
index 7b87b4ea9..0cffdf008 100644
--- a/pbs-key-config/src/lib.rs
+++ b/pbs-key-config/src/lib.rs
@@ -211,7 +211,7 @@ impl KeyConfig {
let derived_key = kdf.derive_key(&passphrase)?;
- if raw_data.len() < 32 {
+ if raw_data.len() < EXPECTED_KEY_LEN + 1 {
bail!("Unable to decrypt key - short data");
}
let iv = &raw_data[0..16];
--
2.47.3
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH proxmox-backup] pbs-key-config: ensure password-protected key is long enough
2026-11-05 11:07 [PATCH proxmox-backup] pbs-key-config: ensure password-protected key is long enough Fabian Grünbichler
@ 2026-11-10 9:01 ` Christian Ebner
2026-11-10 9:06 ` Fabian Grünbichler
2026-11-11 22:36 ` applied: (subset) " Thomas Lamprecht
1 sibling, 1 reply; 4+ messages in thread
From: Christian Ebner @ 2026-11-10 9:01 UTC (permalink / raw)
To: Fabian Grünbichler, pbs-devel
On 11/5/26 12:07 PM, Fabian Grünbichler wrote:
> while openssl fails if provided an empty slice, the resulting error message
> points at the password instead of the key. checking for at least one byte of
> data ensures plain and password-protected keys are distinguished.
>
> Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
> ---
> pbs-key-config/src/lib.rs | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/pbs-key-config/src/lib.rs b/pbs-key-config/src/lib.rs
> index 7b87b4ea9..0cffdf008 100644
> --- a/pbs-key-config/src/lib.rs
> +++ b/pbs-key-config/src/lib.rs
> @@ -211,7 +211,7 @@ impl KeyConfig {
>
> let derived_key = kdf.derive_key(&passphrase)?;
>
> - if raw_data.len() < 32 {
> + if raw_data.len() < EXPECTED_KEY_LEN + 1 {
> bail!("Unable to decrypt key - short data");
> }
> let iv = &raw_data[0..16];
+1 for the check, should this really use the EXPECTED_KEY_LEN constant
though?
After all the first 32 bytes here are the IV and tag, not really the key
data... So either we have constants for these as well or stick to the
plain numeric values?
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH proxmox-backup] pbs-key-config: ensure password-protected key is long enough
2026-11-10 9:01 ` Christian Ebner
@ 2026-11-10 9:06 ` Fabian Grünbichler
0 siblings, 0 replies; 4+ messages in thread
From: Fabian Grünbichler @ 2026-11-10 9:06 UTC (permalink / raw)
To: Christian Ebner, pbs-devel
On November 10, 2026 10:01 am, Christian Ebner wrote:
> On 11/5/26 12:07 PM, Fabian Grünbichler wrote:
>> while openssl fails if provided an empty slice, the resulting error message
>> points at the password instead of the key. checking for at least one byte of
>> data ensures plain and password-protected keys are distinguished.
>>
>> Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
>> ---
>> pbs-key-config/src/lib.rs | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/pbs-key-config/src/lib.rs b/pbs-key-config/src/lib.rs
>> index 7b87b4ea9..0cffdf008 100644
>> --- a/pbs-key-config/src/lib.rs
>> +++ b/pbs-key-config/src/lib.rs
>> @@ -211,7 +211,7 @@ impl KeyConfig {
>>
>> let derived_key = kdf.derive_key(&passphrase)?;
>>
>> - if raw_data.len() < 32 {
>> + if raw_data.len() < EXPECTED_KEY_LEN + 1 {
>> bail!("Unable to decrypt key - short data");
>> }
>> let iv = &raw_data[0..16];
>
> +1 for the check, should this really use the EXPECTED_KEY_LEN constant
> though?
>
> After all the first 32 bytes here are the IV and tag, not really the key
> data... So either we have constants for these as well or stick to the
> plain numeric values?
right, probably separate constants and using them in the slice access as
well makes sense.. will send a v2!
^ permalink raw reply [flat|nested] 4+ messages in thread
* applied: (subset) [PATCH proxmox-backup] pbs-key-config: ensure password-protected key is long enough
2026-11-05 11:07 [PATCH proxmox-backup] pbs-key-config: ensure password-protected key is long enough Fabian Grünbichler
2026-11-10 9:01 ` Christian Ebner
@ 2026-11-11 22:36 ` Thomas Lamprecht
1 sibling, 0 replies; 4+ messages in thread
From: Thomas Lamprecht @ 2026-11-11 22:36 UTC (permalink / raw)
To: pbs-devel, Fabian Grünbichler
On Thu, 05 Nov 2026 12:07:25 +0100, Fabian Grünbichler wrote:
> while openssl fails if provided an empty slice, the resulting error message
> points at the password instead of the key. checking for at least one byte of
> data ensures plain and password-protected keys are distinguished.
Applied, thanks!
[1/1] pbs-key-config: ensure password-protected key is long enough
commit: 17675dc28a31614acb62f4528cddd37a7276c4e3
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-11-11 22:36 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-05 11:07 [PATCH proxmox-backup] pbs-key-config: ensure password-protected key is long enough Fabian Grünbichler
2026-11-10 9:01 ` Christian Ebner
2026-11-10 9:06 ` Fabian Grünbichler
2026-11-11 22:36 ` applied: (subset) " Thomas Lamprecht
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.