Skip to content

CLI failure: 'repo.py --sign' fails for RSA #998

Closed

Description

@Silvanoc

Description of issue or feature request:

Signing a root key with the CLI on a bare repository fails for RSA.

The issue can be easily reproduced with following script:

rm -rf tuf-test ; mkdir tuf-test ; cd tuf-test
repo.py --init --bare
repo.py --key rsa --filename root_key --pw 1234
repo.py --trust --pubkeys tufkeystore/root_key.pub --role root
repo.py --sign tufkeystore/root_key --role root --no_release
cd .. ; rm -r tuf-test

Current behavior:

Fails with following error:

Traceback (most recent call last):
  File "/path/to/securesystemslib/securesystemslib/pyca_crypto_keys.py", line 990, in _decrypt
    file_contents.split(_ENCRYPTION_DELIMITER)
ValueError: not enough values to unpack (expected 5, got 1)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/path/to/tuf/scripts/repo.py", line 450, in import_privatekey_from_file
    password)
  File "/path/to/securesystemslib/securesystemslib/keys.py", line 1418, in decrypt_key
    securesystemslib.pyca_crypto_keys.decrypt_key(encrypted_key, passphrase)
  File "/path/to/securesystemslib/securesystemslib/pyca_crypto_keys.py", line 847, in decrypt_key
    json_data = _decrypt(encrypted_key, password)
  File "/path/to/securesystemslib/securesystemslib/pyca_crypto_keys.py", line 993, in _decrypt
    raise securesystemslib.exceptions.CryptoError('Invalid encrypted file.')
securesystemslib.exceptions.CryptoError: Invalid encrypted file.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/silvano/.local/bin/repo.py", line 7, in <module>
    exec(compile(f.read(), __file__, 'exec'))
  File "/path/to/tuf/scripts/repo.py", line 1139, in <module>
    process_command_line_arguments(arguments)
  File "/path/to/tuf/scripts/repo.py", line 260, in process_command_line_arguments
    sign_role(parsed_arguments)
  File "/path/to/tuf/scripts/repo.py", line 592, in sign_role
    role_privatekey = import_privatekey_from_file(keypath, parsed_arguments.pw)
  File "/path/to/tuf/scripts/repo.py", line 457, in import_privatekey_from_file
    encrypted_key, 'rsassa-pss-sha256', password)
  File "/path/to/securesystemslib/securesystemslib/keys.py", line 963, in import_rsakey_from_private_pem
    securesystemslib.formats.PEMRSA_SCHEMA.check_match(pem)
  File "/path/to/securesystemslib/securesystemslib/schema.py", line 205, in check_match
    ' but got ' + repr(object))
securesystemslib.exceptions.FormatError: Expected a string but got b'-----BEGIN RSA PRIVATE KEY-----\nProc-Type: 4,ENCRYPTED\nDEK-Info: AES-256-CBC,66390E8C0987C902E41A0A348B3D46A6\n\nmcJzvYELX8hlX/2C2fKFNj1VgwUBZN74/KVQ49irZ/yQ0EisX4FFk1EKMBJTXtVM\nxoKxAVlxfEHixSdn68idXjcKwDy/8Gj9yKaik55OEEvxKD+KGx8hm6s8efP7UHbF\nDJxPk6+qPiWQ0/ZTy9laAlqUUdqFnRC+2hk+7ZAlpmIAt/EwSRigWuuXHMGKy577\npKKO0ER9WVSPc2ucbCW+g5kT1HMaGhn1G/m+nENDDhO0YZJJLygTaBhGbdD9UTiB\nGfMPrDQ0oEr5khhJeHiRXotkpBwzE2o0bRv5xo+rgJdOyqNX6Ab0+UkUHcPcTpq5\nEmHvo2bhtwLZM7Of5Er4s8fqyxR8/YcqkWsp18VdiVYFI+7decTe3Fpqp/BHv7vd\ngjdxJPFHALhXk8v15DpgSvTTALxUrpiKuU/SZ90DZpCFCPlvyKjwkSupY3kEeY7o\nPF7bGlx7b4uXX3q4iAXJxgWaI5NPdBuHleHxQkfp0WuRmEzzai60PFgA3hjLxLEj\nsrFbzmwqkUt0RNLG5xs1kJtY83Z+UTMPS/O+ieXkt6b2P5iBWrrym9BBcf5erIBs\n7x1C7Nm5Z6Bm0u0L+SMl3AaSARgaOOtKDUeB6WDRb4wp0GIhQoCGsfIC4Q+pM+xN\nUF2btDx/E3k9GmytG4Xt4S0v8EEl9e1gKVjc4Q6KrwwMpatzm3lL6De30Nrc7nSb\ndJQn3ZK+8pTj/d893jLl4MaryP3ppMVbcLx94W+kQbG6eTKRSnogpBElFVefugll\nMFLtVFFbewNADtmqAPD7udwGVFPkTSyIOTN+GFFnr8HPoSjBa7RVxsaS/3+c+aAB\nxjiEElvN9/EuzHeds7S4XgzZcGjbsAzTr0H41U61WZ/hqEb8+KJas+MS7j7x6uVP\n9sy4vBmmG0cTDlFsSEtvqZVMC2ldZ9BkcQ4zWNlZKaHeOcJPUgGN8iicNVyi0NLb\nXnJBBZ/ylAmsHmnNzppCFEBoYpl3KegO8+x4glu8BUeeC8vqZ+Qh8NB20FgkDvDu\nwS/jpw144UbvZcctfm6vJEexuy55cGuPvV6yh6VQ11JS3Io/N+nHNQwpTznyy4+F\n6wB8AvMD/+qznK5pEnnSeDpNybvxcVAojkTCkg/Xhxu0mRXmZ4X7qjlgOTc+QInf\nbQU6LwyeisHr1CHK5NrcOtF5NSGzzksC8eP1N4W9fNTNjNxVZcCGeJ8isQrKb9C+\nOODSYpuhf2DtlAd1lNFniQYyHMmqUJ1Xpi3SkiQZ90WadwI+RD0SusoDkavf2RqM\na1/nXgnWShK+6Nz3rBXwYIozbTkBAlBw/t2rCcQPFqvX4viGEkQKuOPw9hcqOkOn\nWPuo0y5NX4OTlsxi9E+56rKfUwZMSWQt2+RSjGzvViYB/auSO0NlMyTCpoh61Ngs\ng0t25HZqx8Y50mG9dJwkU26HMDu3qDN/CfD5MMh8wGfMmCGSuz6ksxzWfuehHXIv\ngcpLvkSIy4W9E8yMVY5QhG9Ryp+omiUI4JOSGDc/d2n5lvRKIeRFtP5TMREx1+aG\nmow71/+UJ5tSBaHqnAOYJxCSGrb5T5GA5jFZfw9DwBjZi7MHMGckVZszXIeSgJ1h\nsaAQsYQ/BH6k31gDSFm/l7fHX74j0dkoHI8W7gnH1u6pKH/R9sOFWI6I7WGzf6ok\n1YIYKMB11Pn/r75OcS979xZJCSJ/3ChHmS+fhFJ6e34qInebSZqr46V5l/AE5hcu\nHiwIipxIgfm/vaz0ig6z7XJC7l6vWzll8GNIcgr9uOiWyQxMPfdkOBRjzs4oajYF\nVsiw0V/4JnDW4Nb2kI3hrCmyP3OxiwFYGUqpzKph8i93pIgYwamOpzQvnXP0voZe\n1N8aD+91WZVo7nikIdymlJyXnNH4+irHPrZacvypx92xjLQ1DQAilmEjkXJRWQSK\nAgJGp+9SJdzlKzzFpNr00EMjZ7lPe72blgM16PccpXZ9pElB5nuhOOmhG0Bd+Ul1\nGlfV7ARYPVaax6pFVD/KN5TC3+mu3WSxsOxdYeVK/2QBcHBXq+3Y9LoMn1KrRHhb\naWn9utHjqkqy67CBfVumsT+sEYP9kerumpfVH5rraBkDJeiLm9gvC94X+1cxVcLY\nWK69I8ITervYp/Te7sRYOivpsqxsGnOJq1m+x75uIqAIGXSyWKqlOoE05fbJ+0t2\nVPvzaSL16VMtlr2LGhmtm0iSLv3Mv+5UE4X665yDQ6dItwQTUl5S0egMrqy1/d3O\ne4e1Tx+I96djHmghD8CCWply7Rxylp8lNnlYGoteSvGYHjDk8vJ+drL9q/W49uuV\ndCZp5pUNCt8kgtaweHPuDmfc8dNb59wA4RHQRcoYe1jk4olBh6E4DhDrbbNJaAnz\n-----END RSA PRIVATE KEY-----\n'

Expected behavior:

Signing works without failure like it does for ecdsa and ed25519 formats.

Activity

  1. jku commented on Jul 7, 2020

    @jku
    Member

    This was fixed by commit e662f4f.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions