[#42344] [ruby-trunk - Feature #5964][Open] Make Symbols an Alternate Syntax for Strings — Tom Wardrop <tom@...>

23 messages 2012/02/03

[#42443] [ruby-trunk - Bug #5985][Open] miniruby skews "make benchmark" results — Eric Wong <normalperson@...>

21 messages 2012/02/08

[#42444] [ruby-trunk - Bug #5986][Open] Segmentation Fault — Luis Matta <levmatta@...>

16 messages 2012/02/08

[#42471] [ruby-trunk - Feature #5995][Open] calling io_advise_internal() in read_all() — Masaki Matsushita <glass.saga@...>

20 messages 2012/02/10

[#42560] [ruby-trunk - Bug #6011][Open] ruby-1.9.3-p0/lib/webrick/utils.rb:184: [BUG] Segmentation fault — Vit Ondruch <v.ondruch@...>

12 messages 2012/02/13

[#42579] [ruby-trunk - Bug #6012][Open] Proc#source_location also return the column — Roger Pack <rogerpack2005@...>

14 messages 2012/02/14

[#42685] [ruby-trunk - Bug #6036][Open] Test failures in Fedora Rawhide/17 — Bohuslav Kabrda <bkabrda@...>

14 messages 2012/02/16

[#42697] [ruby-trunk - Bug #6040][Open] Transcoding test failure: Big5 to UTF8 not defined (MinGW) — Luis Lavena <luislavena@...>

10 messages 2012/02/16

[#42813] [ruby-trunk - Feature #6065][Open] Allow Bignum marshalling/unmarshalling from C API — Martin Bosslet <Martin.Bosslet@...>

22 messages 2012/02/23

[#42815] [ruby-trunk - Bug #6066][Open] Fix "control may reach end of non-void function" warnings for clang — Eric Hodel <[email protected]>

15 messages 2012/02/23

[#42857] [ruby-trunk - Feature #6074][Open] Allow alias arguments to have a comma — Thomas Sawyer <transfire@...>

20 messages 2012/02/24

[#42891] [ruby-trunk - Feature #6083][Open] Hide a Bignum definition — Koichi Sasada <redmine@...>

23 messages 2012/02/25

[#42906] [ruby-trunk - Bug #6085][Open] Treatment of Wrong Number of Arguments — Marc-Andre Lafortune <ruby-core@...>

14 messages 2012/02/25

[#42949] [ruby-trunk - Bug #6089][Open] Test suite fails with OpenSSL 1.0.1 — Vit Ondruch <v.ondruch@...>

13 messages 2012/02/26

[ruby-core:42453] [ruby-trunk - Bug #5951][Assigned] Exported RSA keys allow pass phrases that are too short

From: Martin Bosslet <Martin.Bosslet@...>
Date: 2012-02-09 01:59:06 UTC
List: ruby-core #42453
Issue #5951 has been updated by Martin Bosslet.

Status changed from Open to Assigned

Aah, that's bad. You can override the check for four characters by passing the password as an additional parameter (probably not what you want) or by giving a block that returns the password to PKey.new.
Other than that, I fear the only option to get consistent behavior here is to either require passwords to be at least four characters long everywhere, or to override OpenSSL's default PEM callback entirely and to provide our own.

The first acknowledges the four character restriction as a sort of "viral constraint", something I'd like to avoid. The second solution could be based on a call to gets or something. I'd prefer that. 

What do you think? 
----------------------------------------
Bug #5951: Exported RSA keys allow pass phrases that are too short
https://bugs.ruby-lang.org/issues/5951

Author: Eric Hodel
Status: Assigned
Priority: Normal
Assignee: Martin Bosslet
Category: ext
Target version: 
ruby -v: ruby 2.0.0dev (2011-12-20 trunk 34073) [x86_64-darwin11.2.0]


=begin

Exporting a key with this code:

  cipher = OpenSSL::Cipher::Cipher.new 'AES-128-CBC'
  pass_phrase = 'woo'

  key_secure = key.export cipher, pass_phrase

  open 'private.secure.pem', 'w' do |io|
    io.write key_secure
  end

Is not loadable:

  $ ruby20 -v -ropenssl -e 'OpenSSL::PKey::RSA.new File.read "private.secure.pem"' 
  ruby 2.0.0dev (2011-12-20 trunk 34073) [x86_64-darwin11.2.0]
  Enter PEM pass phrase: # I typed woo
  phrase is too short, needs to be at least 4 chars

=end



-- 
http://bugs.ruby-lang.org/

In This Thread