Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Decrypting locked key without password gives wrong error message #541

Closed
prd-fox opened this issue Nov 28, 2018 · 2 comments
Closed

Decrypting locked key without password gives wrong error message #541

prd-fox opened this issue Nov 28, 2018 · 2 comments
Labels
0.7.3 bug Something isn't working

Comments

@prd-fox
Copy link
Contributor

prd-fox commented Nov 28, 2018

When decrypting a locked key, the default password of "" is used to denote that a password is not present for this key.

This empty string is then used to actually decrypt the key, and the resulting error message is that it was the wrong password.
The correct error message should state that no password was provided.

@prd-fox prd-fox added the 0.7.3 label Nov 28, 2018
@vietlq
Copy link

vietlq commented Dec 4, 2018

Empty password is actually a valid input for key defivation/key stretching function (Argon2):

https://github.com/jpmorganchase/tessera/blob/e41d15b6459e219095a202af76d9435b922b48df/config/src/main/java/com/quorum/tessera/config/keys/KeyEncryptorImpl.java#L106

If this error is implemented, it will disallow cases where users wish to have empty passwords. So wrong password is rather correct for the cases when empty string is not the correct password.

@prd-fox
Copy link
Contributor Author

prd-fox commented Dec 4, 2018

The user is not able to generate a key with an empty password. If an empty password is provided then it will generate an unlocked key.
The user has no path through the system to generate a locked key with an empty password (unless they manually do the same steps using another tool).

@prd-fox prd-fox added the bug Something isn't working label Dec 21, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
0.7.3 bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants