cred: reject non-32-byte raw ES256 scalars

2026-11-06 19:29:35 +00:00
parent 9e7e5d7b2a
commit a7e99d52f5
1 changed files with 1 additions and 1 deletions
@@ -141,7 +141,7 @@ pub(super) fn read(value: &str, format: &str, passphrase: Option<&str>) -> Resul
            "ed25519" => Key::Ed(SigningKey::from_bytes(
                bytes.as_slice().try_into().map_err(|_| invalid_key())?,
            )),
-            "es256" => {
+            "es256" if bytes.len() == 32 => {
                Key::Ec(p256::ecdsa::SigningKey::from_slice(&bytes).map_err(|_| invalid_key())?)
            }
            "hmac" => Key::Mac(bytes),