Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Show passphrase length advice or allow longer passphrase #137

Open
annybs opened this issue Apr 28, 2023 · 0 comments
Open

Show passphrase length advice or allow longer passphrase #137

annybs opened this issue Apr 28, 2023 · 0 comments

Comments

@annybs
Copy link
Member

annybs commented Apr 28, 2023

At the moment passphrases must be exactly 32 characters due to the cipher length requirement in aes-256-ctr which for short passwords is resolved by padding with zeroes:

cli/src/wallet/wallet.ts

Lines 41 to 44 in 27e0620

/**
* Right-pad a passphrase input to ensure compatibility with the encryption cipher.
*/
const resizePassphrase = (passphrase: string): string => passphrase.padEnd(32, '0')

However, there is no elegant handling of too-long passwords, where an error is encountered instead while creating/restoring a wallet:

[critical] Error: Invalid key length {}

Possible solutions:

  1. Indicate this limit more clearly in CLI and validate passphrase length during input, i.e. loop back, advise, and ask again, rather than stop the process
  2. Find a way to use a larger encryption cipher - but without breaking existing wallets!
  3. Implement custom passphrase elongation via something like recursive encryption using consecutive 32-character sections as ciphers e.g. if the passphrase is 40 characters, then the first 32 characters make up the first cipher, and the last 8 characters are padded with zeroes to make up the second cipher
@annybs annybs self-assigned this Apr 28, 2023
@annybs annybs removed their assignment May 22, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant