[CHEF-5356] Encrypted data bags should use different HMAC key and include the IV in the HMAC

https://tickets.opscode.com/browse/CHEF-5356
A minimum length doesn't have to be a recommended length. I would want to
raise, not warn, below a certain length. My feeling is the computational
cycles here for erring toward longer keys here are cheap.
On Jun 11, 2014 3:51 PM, "Xabier de Zuazo" <notifications@github.com> wrote:

> In lib/chef/encrypted_data_bag_item/decryptor.rb:
>
> > @@ -197,5 +199,33 @@ def candidate_hmac_matches?(expected_hmac)
> >          valid == 0
> >        end
> >      end
> > +
> > +    class Version3Decryptor < Version2Decryptor
> > +
> > +      def initialize(encrypted_data, key)
> > +        @encrypted_data = encrypted_data
> > +
> > +        # split the hmac key form the key
> > +        @hmac_key, @key = key.unpack("Z#{key.length/2}Z*")
>
>  Since this is a new version of this feature, how about we require a
> minimum secret length?
>
> In my first implementation, I added a warning if the secret was to short.
> But I removed in the final PR because I really did not know what to choose
> as recommended length.
>
> In the Official Data Bags documentation
> <http://docs.opscode.com/chef/essentials_data_bags.html#secret-keys>, a
> secret length of *684 bytes* is used. Maybe double that size?
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/opscode/chef/pull/1474/files#r13670081>.
>