blowfish_secret of not exactly 32 characters causes server error

[ibennetch]

QA_5_2 and master have a problem if blowfish_secret isn't exactly 32 bytes long. The main pane is blank aside from the top tabs and this is logged:

PHP Fatal error:  Uncaught ErrorException: The secret passphrase in configuration (blowfish_secret) is not the correct length. It should be 32 bytes long. in /var/www/pma-dev/fork/libraries/classes/Controllers/HomeController.php:330\nStack trace:\n#0 [internal function]: PhpMyAdmin\\ErrorHandler->handleError()\n#1 /var/www/pma-dev/fork/libraries/classes/Controllers/HomeController.php(330): trigger_error()\n#2 /var/www/pma-dev/fork/libraries/classes/Controllers/HomeController.php(220): PhpMyAdmin\\Controllers\\HomeController->checkRequirements()\n#3 /var/www/pma-dev/fork/libraries/classes/Routing.php(187): PhpMyAdmin\\Controllers\\HomeController->__invoke()\n#4 /var/www/pma-dev/fork/index.php(43): PhpMyAdmin\\Routing::callControllerForRoute()\n#5 {main}\n  thrown in /var/www/pma-dev/fork/libraries/classes/Controllers/HomeController.php on line 330

We should definitely handle this more gracefully and show the user a warning that their blowfish_secret isn't the correct length.

[xkill]

Hi, I'm using a 93 chars secret, and I'm also having this problem. 5.2.0 just updated from 5.1.3.

[svivian]

Is there a reason it needs to be exactly 32 characters long? Surely a longer key is more secure?

[williamdes]

Is there a reason it needs to be exactly 32 characters long? Surely a longer key is more secure?

Seems like this is a technical issue from the php extension: https://www.php.net/manual/en/function.sodium-crypto-secretbox.php

If key has a length of bytes different than SODIUM_CRYPTO_SECRETBOX_KEYBYTES (32 bytes), a SodiumException will be thrown.

[J0riz]

We just updated phpMyAdmin on one of our staging servers to phpMyAdmin 5.2.
We noticed that after login you see the follow message in a red box:
The secret passphrase in configuration (blowfish_secret) is not the correct length. It should be 32 bytes long.

No further errors are logged or thrown. So except this confusing error phpMyAdmin works fine.
We currently use a longer key what should be fine. I agree with @svivian that a longer key should be more secure.

I see this was changed in this commit: 411bacf

If it actually should always be 32 bit length I think this should be improved in the documentation.
Now the documentation mentions:

The secret should be 32 characters long. Using shorter will lead to weaker security of encrypted cookies, using longer will cause no harm.

[nifaracing]

any News about this?

[williamdes]

If it actually should always be 32 bit length I think this should be improved in the documentation.
Now the documentation mentions:
The secret should be 32 characters long. Using shorter will lead to weaker security of encrypted cookies, using longer will cause no harm.

I agree it should be re-phrased

A longer key will not be more secure because the software will not accept it

[ankurk91]

I generated secret using

openssl rand -base64 32

wWzOmmkU3VX5BBaToePoWv55m+g9I6suhnWmbrpXXtw=

i am still getting error.

PS.
I made it exactly 32 char long with this command, it worked
openssl rand -base64 22

[chrysthianprudencio]

I generated secret using

openssl rand -base64 32

wWzOmmkU3VX5BBaToePoWv55m+g9I6suhnWmbrpXXtw=

i am still getting error.

PS. I made it exactly 32 char long with this command, it worked openssl rand -base64 22

it worked thanks bro!!

[weikengchen]

I find a probably better solution is to do something like the following, so it is still a proper 32-byte key.

base64_decode('wWzOmmkU3VX5BBaToePoWv55m+g9I6suhnWmbrpXXtw=')

But I think it should be more user-friendly.