Repository navigation
Conversation
`to_bytes_be()` drops leading zero bytes, so about 1 in 256 public keys was sent short. KWallet's ksecretd before 6.25.0 rejects such keys with "Client public key size is invalid". Pad the key to the group size, as `derive_shared` already does for the shared secret. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Session::newsends the client's DH public key askeypair.public.to_bytes_be(), which drops leading zero bytes. About 1 in 256 freshly generated keys therefore goes out as 127 bytes or fewer.KWallet's Secret Service daemon (ksecretd) before 6.25.0 rejects public keys shorter than 128 bytes with
Client public key size is invalid. So against those versions, about 0.4% ofSecretService::connect(EncryptionType::Dh)calls fail at random. Distributions still ship them, e.g. Ubuntu 26.04 LTS has kwallet6 6.24.0. KDE removed the check in kwallet 307db62 (bug 514194), but older installs will be around for a while.This change pads the public key to the 1024-bit group size (128 bytes), the same way
derive_sharedalready pads the shared secret. Leading zeros don't change the value for services that read the key as an unsigned big-endian integer, as libsecret's DH code does.Testing
Added a unit test for the padding; it passes with both
crypto-rustandcrypto-openssl.Ran 3000 encrypted sessions against ksecretd 6.24.0 (through
dbus-secret-service-keyring-store1.0.1):Client public key size is invalidksecretd 6.24.0 has two more bugs in the same handshake, and they still cause occasional
Unpad Errors. It doesn't pad the shared secret, and it reads the client key as a signed integer. Both are server-side, and the same KDE commit fixes them, so this PR doesn't try to work around them.