-
Notifications
You must be signed in to change notification settings - Fork 15
Description
Description:
When loading a tampered or corrupted Crypt4GH private key, decryption fails with a raw cryptography.exceptions.InvalidTag exception. While this is technically correct, it’s not user-friendly and may confuse users.
Suggestion:
Catch this exception and raise a clearer message like:
"Decryption failed: The private key is corrupted or the passphrase is incorrect."
Steps to reproduce:
-
Encrypt a private key.
-
Modify two bytes in the key file (I changed values in columns 107 and 108)
-
Try to decrypt with crypt4gh decrypt.
-
The output i get:
crypt4gh decrypt --sk ./keys-private/crypt4gh_orig_changed.key < Dockerfile_download.c4gh > Dockerfile_download_fail
Warning: Using a passphrase in an environment variable is insecure
Traceback (most recent call last):
File "/home/alex/python/crypt4gh-env/bin/crypt4gh", line 8, in
sys.exit(main())
^^^^^^
File "/home/alex/python/crypt4gh-env/lib/python3.12/site-packages/crypt4gh/main.py", line 21, in main
cmd(args)
File "/home/alex/python/crypt4gh-env/lib/python3.12/site-packages/crypt4gh/cli.py", line 173, in decrypt
seckey = retrieve_private_key(args)
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/alex/python/crypt4gh-env/lib/python3.12/site-packages/crypt4gh/cli.py", line 125, in retrieve_private_key
return get_private_key(seckeypath, cb)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/alex/python/crypt4gh-env/lib/python3.12/site-packages/crypt4gh/keys/init.py", line 122, in get_private_key
return c4gh.parse_private_key(stream, callback)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/alex/python/crypt4gh-env/lib/python3.12/site-packages/crypt4gh/exceptions.py", line 39, in wrapper
return func(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^
File "/home/alex/python/crypt4gh-env/lib/python3.12/site-packages/crypt4gh/keys/c4gh.py", line 132, in parse_private_key
return ChaCha20Poly1305(shared_key).decrypt(nonce, encrypted_data, None) # No add
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
cryptography.exceptions.InvalidTag
Thanks for the great work!