Re: [PATCH proxmox-backup] pbs-key-config: ensure password-protected key is long enough

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

On November 10, 2026 10:01 am, Christian Ebner wrote:
> On 11/5/26 12:07 PM, Fabian Grünbichler wrote:
>> while openssl fails if provided an empty slice, the resulting error message
>> points at the password instead of the key. checking for at least one byte of
>> data ensures plain and password-protected keys are distinguished.
>> 
>> Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
>> ---
>>   pbs-key-config/src/lib.rs | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>> 
>> diff --git a/pbs-key-config/src/lib.rs b/pbs-key-config/src/lib.rs
>> index 7b87b4ea9..0cffdf008 100644
>> --- a/pbs-key-config/src/lib.rs
>> +++ b/pbs-key-config/src/lib.rs
>> @@ -211,7 +211,7 @@ impl KeyConfig {
>>   
>>               let derived_key = kdf.derive_key(&passphrase)?;
>>   
>> -            if raw_data.len() < 32 {
>> +            if raw_data.len() < EXPECTED_KEY_LEN + 1 {
>>                   bail!("Unable to decrypt key - short data");
>>               }
>>               let iv = &raw_data[0..16];
> 
> +1 for the check, should this really use the EXPECTED_KEY_LEN constant 
> though?
> 
> After all the first 32 bytes here are the IV and tag, not really the key 
> data... So either we have constants for these as well or stick to the 
> plain numeric values?

right, probably separate constants and using them in the slice access as
well makes sense.. will send a v2!