search

sii / siptrackd

Other
0 stars 4 forks source link

Long passwords cause AES key error #5

Open stemid opened 7 years ago

stemid commented 7 years ago

Triggered by the new reconnect feature for password keys in the user profile page.

The reconnect feature uses isValidPassword to check the password before disconnecting the old key. Apparently very long passwords cause this error. 

  File "/home/siptrack/siptrack/siptrackd/siptrackd_twisted/helpers.py", line 86, in wrapped_f
    ret = func(*args, **kwargs)
  File "/home/siptrack/siptrack/siptrackd/siptrackd_twisted/password.py", line 98, in xmlrpc_is_valid_password
    ret_value = pk.isValidPassword(test_password)
  File "/home/siptrack/siptrack/siptrackd/siptrackdlib/password.py", line 263, in isValidPassword
    verify_crypt = self._encrypt(password.padded, self._verify_clear.get())
  File "/home/siptrack/siptrack/siptrackd/siptrackdlib/password.py", line 223, in _encrypt
    aesobj = AES.new(password, AES.MODE_ECB)
  ValueError: AES key must be either 16, 24, or 32 bytes long
stemid commented 6 years ago

In retrospect this is just an effect of using AES with ECB mode because it only allows keys to be 32 bytes in size. This is checked in PasswordKey._created but perhaps a multi-byte character snuck in to trigger this error.