Consistent errors for KeyStoreWrapper decryption with any security provider
#57,132 opened on May 26, 2020
Repository metrics
- Stars
- (76,700 stars)
- PR merge metrics
- (Avg merge 2d) (1,000 merged PRs in 30d)
Description
As identified in https://github.com/elastic/elasticsearch/pull/57050#issuecomment-633257786 , when using the BouncyCastle FIPS security provider, the decryption with a wrong password fails in non predictable ways. Sometimes the CipherInputStream doesn't throw an AEADBadTagException as expected but readFully fails to read the stream fully and thus we fail because of these unconsumed stream contents: https://github.com/elastic/elasticsearch/blob/c117c0cf0a2e1a497c83278cebb7a2da57c2f599/server/src/main/java/org/elasticsearch/common/settings/KeyStoreWrapper.java#L379
We should look at a) why this happens and b) figure out if there is a way to consistently catch Exceptions caused by invalid passwords for any security provider so that we can throw a relevant and useful error message for the users.