trending/scriptc
1
0
Fork 0
mirror of https://github.com/vercel-labs/scriptc.git synced 2026-11-01 07:33:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

Report either decryption error of a wrong passphrase in corpus 8183

Browse Source 
With a fresh key and IV each run, Node's OpenSSL now and then accepts
the padding of a wrong-passphrase decryption and rejects the decrypted
structure instead: ERR_OSSL_UNSUPPORTED rather than ERR_OSSL_BAD_DECRYPT,
in about 1 run in 100. The program now prints both as one decryption
error.
This commit is contained in:
Chris Tate
2026-10-25 14:04:10 -05:00
parent cab0968510
commit 6000485a17
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/corpus/8183-key-passphrase-encoding.cjs
+6 -1
View File
@@ -9,12 +9,17 @@ const hex = Buffer.from(pass).toString("hex");
const pem = privateKey.export({ format: "pem", type: "pkcs8", cipher: "aes-256-cbc", passphrase: hex, encoding: "hex" });
const der = privateKey.export({ format: "der", type: "pkcs8", cipher: "aes-128-cbc", passphrase: pass });
// A wrong passphrase usually fails the decryption's padding check
// (ERR_OSSL_BAD_DECRYPT); with a fresh key and IV each run, Node's
// OpenSSL now and then accepts the padding and rejects the decrypted
// structure instead (ERR_OSSL_UNSUPPORTED). Both are reported as one.
function attempt(label, options) {
try {
const key = c.createPrivateKey(options);
console.log(label, key.asymmetricKeyType, key.equals(privateKey));
} catch (e) {
console.log(label, "throws", e.code);
const wrong = e.code === "ERR_OSSL_BAD_DECRYPT" || e.code === "ERR_OSSL_UNSUPPORTED";
console.log(label, "throws", wrong ? "a decryption error" : e.code);
}
}