luckyframework / authentic

An authentication library for Lucky projects
MIT License
14 stars 13 forks source link

Fix the secret_key validation to allow any string >= 32 bytes #67

Closed jwoertink closed 3 years ago

jwoertink commented 3 years ago

This gets pushed down to OpenSSL::Cipher which requires at least 32 bytes. The error you get from Crystal is a little misleading which made me think it had to be exactly 32.

Unhandled exception: Key length too short: wanted 32, got 28 (ArgumentError)

require "openssl/cipher"
require "random/secure"

str = Random::Secure.base64(32)

cipher = OpenSSL::Cipher.new("aes-256-cbc")
cipher.encrypt
cipher.key = str
iv = cipher.random_iv
encrypted_data = IO::Memory.new
encrypted_data.write(cipher.update("super secret"))
encrypted_data.write(cipher.final)
encrypted_data.write(iv)

encrypted_data.to_slice