HomeFreeBSD

get_key_material: skip passphrase validation when loading keys

Description

get_key_material: skip passphrase validation when loading keys

The restriction that an encryption key must be at least
MIN_PASSPHRASE_LEN characters long make sense when changing the
encryption key, but not when loading: as this restriction is not
enforced in the libraries, it is possible to bypass zfs change-key's
restrictions and end up with a key that becomes impossible to load with
zfs load-key, for example through pam_zfs_key.

Reviewed-by: Felix Dörre <felix@dogcraft.de>
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Harald van Dijk <harald@gigawatt.nl>
Closes #12765

Details

Provenance
Harald van Dijk <harald@gigawatt.nl>Authored on Oct 19 2021, 11:32 PM
Brian Behlendorf <behlendorf1@llnl.gov>Committed on Nov 30 2021, 7:54 PM
Parents
rG4234812d1a20: pam_zfs_key: tests: check if zfs load-key works on short passphrases
Branches
Unknown
Tags
Unknown

Event Timeline

Brian Behlendorf <behlendorf1@llnl.gov> committed rG85638aa87003: get_key_material: skip passphrase validation when loading keys (authored by Harald van Dijk <harald@gigawatt.nl>).Nov 30 2021, 7:54 PM