Checking for errors in aead::seal

[is-ahmed]

right now I'm trying to build a toy password manager in rust, and I'm using this crate for encrypting the file storing the credentials. I don't know much about rust or crypto so feel free to give additional pointers about making it more secure and stuff.

The repo is here: https://github.com/is-ahmed/arustylock
most up-to-date branch is encrypt-data

The error is happening here where I'm initialising the dir holding the credential data for the first time

main.rs: https://github.com/is-ahmed/arustylock/blob/encrypt-data/src/main.rs#L120

if !Path::new(config_dir.as_str()).exists() {
        Command::new("mkdir")
            .arg(&config_dir)
            .output()
            .expect("Error making .arustylock directory");
        let passwords_path = format!("{}", &store_path);
        let mut store = OpenOptions::new()
            .read(true)
            .write(true)
            .create(true)
            .open(&passwords_path)
            .unwrap();

        store
            .write(b"[{\"domain\": \"\", \"username\": \"\", \"password\": \"\" }]")
            .unwrap();

        let key = aead::SecretKey::default();
        encrypt_data(&mut store, &key);
    }

and the main thread panics here in the encryption when I call aead::seal

encryption.rs:https://github.com/is-ahmed/arustylock/blob/encrypt-data/src/encryption/encryption.rs#L6

pub fn encrypt_data(file: &mut File, key_ref: &aead::SecretKey) {
    let mut buffer = Vec::new();
    file.read_to_end(&mut buffer)
        .expect("Error reading file to buffer");
    let cipher_text = aead::seal(key_ref, &buffer).unwrap();
    file.write_all(&cipher_text).unwrap();
}

I've been looking at these possible errors here: https://docs.rs/orion/0.16.0/orion/aead/index.html#errors but I can't seem to figure out which one is happening. Any ideas?

Let me know if there's more information you need and thanks in advance!

EDIT (July 22. 2022) - Forgot, here's the backtrace I got

thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: UnknownCryptoError', src/encryption/encryption.rs:10:52
stack backtrace:
   0: rust_begin_unwind
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:584:5
   1: core::panicking::panic_fmt
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panicking.rs:143:14
   2: core::result::unwrap_failed
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/result.rs:1785:5
   3: core::result::Result<T,E>::unwrap
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/result.rs:1078:23
   4: arustylock::encryption::encryption::encrypt_data
             at ./src/encryption/encryption.rs:10:23
   5: arustylock::main
             at ./src/main.rs:138:9
   6: core::ops::function::FnOnce::call_once
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/ops/function.rs:227:5

[vlmutolo]

I'm having a hard time reproducing the error on my machine. Could you provide a series of steps to get to the crypto error from a freshly cloned repo?

That said, if I had to guess, I'd bet you're probably passing in an empty buffer to encrypt.

---

EDIT: I got it to reproduce. The created $HOME/.arustylock has to be missing first, so the following command works on a fresh repo to reproduce:

rm -rf $HOME/.arustylock && cargo run

Also I confirmed that the buffer is empty, which is causing the error. I added

dbg!(buffer.is_empty());

on line 10, just before the call to aead::seal, and it printed true.

[is-ahmed]

Thank you! The problem was that the after I wrote to the file, the file cursor was at the end of the file, so reading from it would produce nothing.

This was fixed by adding in this line before the call to file.read_to_end

file.seek(SeekFrom::Start(0)).expect("Failed to seek");