From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 8311E6C872 for ; Mon, 1 Feb 2021 14:06:54 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 775712481F for ; Mon, 1 Feb 2021 14:06:24 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [212.186.127.180]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id 4A74B24812 for ; Mon, 1 Feb 2021 14:06:23 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 186CB45796 for ; Mon, 1 Feb 2021 14:06:23 +0100 (CET) From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= To: pbs-devel@lists.proxmox.com Date: Mon, 1 Feb 2021 14:06:16 +0100 Message-Id: <20210201130618.800923-1-f.gruenbichler@proxmox.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.027 Adjusted score from AWL reputation of From: address KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pbs-devel] [PATCH proxmox-backup 1/3] paperkey: allow RSA keys without passphrase X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Feb 2021 13:06:54 -0000 some users might want to store the plain version of their master key for long-term storage and rely on physical security instead of a passphrase to protect the paper key. Signed-off-by: Fabian Grünbichler --- Notes: our tooling does not create passphrase-less master keys, so this needs a conscious step by the user to remove the set passphrase anyway.. src/tools/paperkey.rs | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/src/tools/paperkey.rs b/src/tools/paperkey.rs index 030275cc..859e8aed 100644 --- a/src/tools/paperkey.rs +++ b/src/tools/paperkey.rs @@ -30,8 +30,16 @@ pub fn generate_paper_key( subject: Option, output_format: Option, ) -> Result<(), Error> { + let (data, is_master_key) = if data.starts_with("-----BEGIN ENCRYPTED PRIVATE KEY-----\n") + || data.starts_with("-----BEGIN RSA PRIVATE KEY-----\n") + { + let data = data.trim_end(); + if !(data.ends_with("\n-----END ENCRYPTED PRIVATE KEY-----") + || data.ends_with("\n-----END RSA PRIVATE KEY-----")) + { + bail!("unexpected key format"); + } - let (data, is_private_key) = if data.starts_with("-----BEGIN ENCRYPTED PRIVATE KEY-----\n") { let lines: Vec = data .lines() .map(|s| s.trim_end()) @@ -39,10 +47,6 @@ pub fn generate_paper_key( .map(String::from) .collect(); - if !lines[lines.len()-1].starts_with("-----END ENCRYPTED PRIVATE KEY-----") { - bail!("unexpected key format"); - } - if lines.len() < 20 { bail!("unexpected key format"); } @@ -68,8 +72,8 @@ pub fn generate_paper_key( let format = output_format.unwrap_or(PaperkeyFormat::Html); match format { - PaperkeyFormat::Html => paperkey_html(output, &data, subject, is_private_key), - PaperkeyFormat::Text => paperkey_text(output, &data, subject, is_private_key), + PaperkeyFormat::Html => paperkey_html(output, &data, subject, is_master_key), + PaperkeyFormat::Text => paperkey_text(output, &data, subject, is_master_key), } } @@ -77,7 +81,7 @@ fn paperkey_html( mut output: W, lines: &[String], subject: Option, - is_private: bool, + is_master: bool, ) -> Result<(), Error> { let img_size_pt = 500; @@ -107,7 +111,7 @@ fn paperkey_html( writeln!(output, "

Subject: {}

", subject)?; } - if is_private { + if is_master { const BLOCK_SIZE: usize = 20; let blocks = (lines.len() + BLOCK_SIZE -1)/BLOCK_SIZE; -- 2.20.1