Re: [PATCH proxmox-backup] pbs-key-config: ensure password-protected key is long enough

[Christian Ebner <c.ebner@proxmox.com>]

On 11/5/26 12:07 PM, Fabian Grünbichler wrote:
> while openssl fails if provided an empty slice, the resulting error message
> points at the password instead of the key. checking for at least one byte of
> data ensures plain and password-protected keys are distinguished.
> 
> Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
> ---
>   pbs-key-config/src/lib.rs | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/pbs-key-config/src/lib.rs b/pbs-key-config/src/lib.rs
> index 7b87b4ea9..0cffdf008 100644
> --- a/pbs-key-config/src/lib.rs
> +++ b/pbs-key-config/src/lib.rs
> @@ -211,7 +211,7 @@ impl KeyConfig {
>   
>               let derived_key = kdf.derive_key(&passphrase)?;
>   
> -            if raw_data.len() < 32 {
> +            if raw_data.len() < EXPECTED_KEY_LEN + 1 {
>                   bail!("Unable to decrypt key - short data");
>               }
>               let iv = &raw_data[0..16];

+1 for the check, should this really use the EXPECTED_KEY_LEN constant 
though?

After all the first 32 bytes here are the IV and tag, not really the key 
data... So either we have constants for these as well or stick to the 
plain numeric values?