Pad short secrets

README.rst

@@ -98,7 +98,8 @@ for AES256-GCM, with a 16-byte randomly generated initialization vector.
 The encryption produces both the ciphertext as well as a "tag" that is
 used as part of integrity verification. The iv, ciphertext, and tag (in
 that order) are concatenated, base64-encoded, and prepended with ``$7$``
-to produce the encrypted password seen in the configuration files.
+to produce the encrypted password seen in the configuration files. If
+the key is less than 254-bytes it is padded with null bytes.
 
 Phantom
 ~~~~~~~

splunksecrets.py

@@ -63,7 +63,8 @@ def decrypt(secret, ciphertext, nosalt=False):
         plaintext = "".join([six.unichr(c) for c in chars])
     elif ciphertext.startswith("$7$"):
         if len(secret) < 254:
-            raise ValueError(f"secret too short, need 254 bytes, got {len(secret)}")
+            print(f"secret too short ({len(secret)} bytes), padding to 254 bytes with nulls")
+            secret = secret.ljust(254, b"\0")
         ciphertext = b64decode(ciphertext[3:])
 
         kdf = PBKDF2HMAC(
@@ -120,7 +121,8 @@ def encrypt(secret, plaintext, nosalt=False):
 def encrypt_new(secret, plaintext, iv=None):  # pylint: disable=invalid-name
     """Use the new AES 256 GCM encryption in Splunk 7.2"""
     if len(secret) < 254:
-        raise ValueError(f"secret too short, need 254 bytes, got {len(secret)}")
+        print(f"secret too short ({len(secret)} bytes), padding to 254 bytes with nulls")
+        secret = secret.ljust(254, b"\0")
 
     kdf = PBKDF2HMAC(
         algorithm=hashes.SHA256(),

tests.py

@@ -105,10 +105,13 @@ def test_encrypt_new(self):
         )
         self.assertEqual(ciphertext, "$7$aTVkS01HYVNJUk5wSnR5NKR+EdOfT4t84WSiXvPFHGHsfHtbgPIL3g==")
 
-    def test_encrypt_new_raises_value_error_short_secret(self):
-        with self.assertRaises(ValueError):
-            splunk_secret = base64.b64encode(os.urandom(255))[:253]
-            splunksecrets.encrypt_new(splunk_secret, "temp1234")
+    def test_encrypt_new_pads_short_secret(self):
+        ciphertext = splunksecrets.encrypt_new(
+            splunk_secret[:30],
+            "short123",
+            iv=six.b("4KK0Ra8LWBKxUFQ8")
+        )
+        self.assertEqual(ciphertext, "$7$NEtLMFJhOExXQkt4VUZROK9vm0tDLbJn2jxESMRbs7MTdiHuTtBz8g==")
 
     def test_encrypt_character_matches_salt1(self):
         ciphertext = splunksecrets.encrypt(splunk_secret, "A" * 8)