This repository was archived by the owner on Jul 12, 2026. It is now read-only.
Fix legacy_decrypt to use password-derived Fernet key (#185)#202
Open
Yupsecous wants to merge 1 commit into
Open
Fix legacy_decrypt to use password-derived Fernet key (#185)#202Yupsecous wants to merge 1 commit into
Yupsecous wants to merge 1 commit into
Conversation
) legacy_decrypt derived a key from the password via PBKDF2 but then discarded it and called Fernet::generate_key(), so decryption used a random key and always failed on real legacy keyfiles. Encode the PBKDF2-derived key with URL-safe base64 (matching Python cryptography's Fernet key format) and use it for decryption. Also replace the Fernet::new(...).unwrap() with proper KeyFileError propagation, and add a regression test covering the legacy decrypt path. The regression test is gated to non-python-bindings builds: it drives decrypt_keyfile_data, whose call graph reaches utils::print, which under python-bindings executes Python via pyo3. A standalone Rust test binary cannot link that under extension-module (libpython is intentionally not linked), so the test runs under default features (e.g. cargo test) and is skipped when python-bindings is enabled.
Yupsecous
force-pushed
the
fix/legacy-decrypt-185
branch
from
June 4, 2026 10:27
dab602a to
ce7970a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
legacy_decrypt derived a key from the password via PBKDF2 but then discarded it and called Fernet::generate_key(), so decryption used a random key and always failed on real legacy keyfiles. Encode the PBKDF2-derived key with URL-safe base64 (matching Python cryptography's Fernet key format) and use it for decryption. Also replace the Fernet::new(...).unwrap() with proper KeyFileError propagation, and add a regression test covering the legacy decrypt path.