{"record":{"id":"72d98aadcd020fde","repo":"embassy-rs/embassy","slug":"passphrase-is-too-short-or-too-long","errorCode":null,"errorMessage":"Passphrase is too short or too long","messagePattern":"Passphrase is too short or too long","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cyw43/src/control.rs","lineNumber":488,"sourceCode":"    ///\n    /// Requires compatible CYW43 firmware and client support.\n    pub async fn start_ap_wpa3(&mut self, ssid: &str, passphrase: &str, channel: u8) {\n        self.start_ap(ssid, passphrase, ApAuth::Wpa3, channel).await;\n    }\n\n    /// Start WPA2/WPA3 transition mode access point.\n    ///\n    /// WPA3 requires compatible CYW43 firmware and client support.\n    pub async fn start_ap_wpa2_wpa3(&mut self, ssid: &str, passphrase: &str, channel: u8) {\n        self.start_ap(ssid, passphrase, ApAuth::Wpa2Wpa3, channel).await;\n    }\n\n    /// Start an access point with the specified authentication type.\n    ///\n    /// WPA3 requires compatible CYW43 firmware and client support.\n    pub async fn start_ap(&mut self, ssid: &str, passphrase: &str, auth: ApAuth, channel: u8) {\n        if auth != ApAuth::Open && (passphrase.len() < MIN_PSK_LEN || passphrase.len() > MAX_PSK_LEN) {\n            panic!(\"Passphrase is too short or too long\");\n        }\n\n        let (security, mfp, wpa_auth) = match auth {\n            ApAuth::Open => (Security::OPEN, MFP_NONE, WPA_AUTH_DISABLED),\n            ApAuth::Wpa2 => (Security::WPA2_AES_PSK, MFP_NONE, WPA_AUTH_WPA2_PSK | WPA_AUTH_WPA_PSK),\n            ApAuth::Wpa3 => (Security::WPA3_SAE, MFP_REQUIRED, WPA_AUTH_WPA3_SAE_PSK),\n            ApAuth::Wpa2Wpa3 => (\n                Security::WPA3_WPA2_PSK,\n                MFP_CAPABLE,\n                WPA_AUTH_WPA2_PSK | WPA_AUTH_WPA3_SAE_PSK,\n            ),\n        };\n\n        // Temporarily set wifi down\n        self.down().await;\n\n        // Turn off APSTA mode\n        self.set_iovar_u32(\"apsta\", 0).await;","sourceCodeStart":470,"sourceCodeEnd":506,"githubUrl":"https://github.com/embassy-rs/embassy/blob/463a07b963419a1bfe61d5d597c44acb810afb8b/cyw43/src/control.rs#L470-L506","documentation":"cyw43's `start_ap` panics when the AP passphrase length is outside the WPA PSK limits: shorter than MIN_PSK_LEN (8) or longer than MAX_PSK_LEN (64). WPA/WPA2/WPA3 PSKs must be 8-64 bytes per the 802.11 standard, so the driver rejects invalid lengths eagerly instead of failing in firmware. Open APs are exempt because no passphrase is used.","triggerScenarios":"Calling `Control::start_ap` (directly or via `start_ap_open`-style wrappers passing auth != ApAuth::Open) with a passphrase shorter than 8 characters or longer than 64 bytes. Only checked when `auth` is not `ApAuth::Open`.","commonSituations":"Hardcoding a short test password like \"12345\" for a WPA2 access point; passing an empty string while meaning an open AP but supplying Wpa2; generating a 64+ byte key by encoding raw 32-byte material as longer hex; firmware migration where an older driver silently accepted short keys.","solutions":["Ensure the passphrase is between 8 and 64 bytes long before calling start_ap","If you want no password, pass `ApAuth::Open` instead of a short passphrase","Derive a PSK from longer user input (e.g. hash it) when users supply arbitrary passwords","Clamp or reject user-supplied SSID/passphrase input in your application config layer before reaching the driver"],"exampleFix":"// before\ncontrol.start_ap(\"myssid\", \"short\", ApAuth::Wpa2, 6).await;\n// after\nlet passphrase = \"correct-horse-battery\"; // 8..=64 bytes\ncontrol.start_ap(\"myssid\", passphrase, ApAuth::Wpa2, 6).await;","handlingStrategy":"validation","validationCode":"const MIN_PSK_LEN: usize = 8;\nconst MAX_PSK_LEN: usize = 64;\nfn valid_ap_passphrase(pass: &str, auth: ApAuth) -> bool {\n    if auth == ApAuth::Open { return true; }\n    let n = pass.as_bytes().len();\n    (MIN_PSK_LEN..=MAX_PSK_LEN).contains(&n)\n}\n// call: assert!(valid_ap_passphrase(pass, auth), \"passphrase must be 8..=64 bytes\");","typeGuard":"fn is_open_auth(auth: ApAuth) -> bool { matches!(auth, ApAuth::Open) }","tryCatchPattern":null,"preventionTips":["Validate user-supplied Wi-Fi passwords for 8..=64 byte length in the app config layer","Use ApAuth::Open for password-less APs instead of an empty/short passphrase","Store AP credentials as fixed-length validated values, not free-form strings"],"tags":["embedded","wifi","wireless","panic","validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"463a07b963419a1bfe61d5d597c44acb810afb8b","analyzedAt":"2026-09-10T13:38:26.660Z","contentChangedAt":"2026-09-10T13:38:26.660Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}