{"record":{"id":"74934ae32a77f150","repo":"moonD4rk/HackBrowserData","slug":"yandex-decrypted-intermediate-key-shorter-than-32","errorCode":null,"errorMessage":"yandex: decrypted intermediate key shorter than 32 bytes","messagePattern":"yandex: decrypted intermediate key shorter than 32 bytes","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crypto/yandex.go","lineNumber":22,"sourceCode":"\t\"bytes\"\n\t\"errors\"\n)\n\n// yandexSignature is the protobuf wire-format header (field1 varint=1, field2 len=32) on every wrapped key.\nvar yandexSignature = []byte{0x08, 0x01, 0x12, 0x20}\n\nvar localEncryptorPrefix = []byte(\"v10\")\n\nconst (\n\tyandexIntKeyBlobLen = 96 // 12B nonce + 68B ciphertext + 16B GCM tag\n\tyandexDataKeyLen    = 32\n)\n\nvar (\n\terrYandexMarkerNotFound = errors.New(\"yandex: v10 marker not found in local_encryptor_data\")\n\terrYandexBlobShort      = errors.New(\"yandex: encrypted intermediate key truncated\")\n\terrYandexBadSignature   = errors.New(\"yandex: invalid protobuf signature on decrypted key\")\n\terrYandexKeyTooShort    = errors.New(\"yandex: decrypted intermediate key shorter than 32 bytes\")\n)\n\n// DecryptYandexIntermediateKey unwraps the per-DB data key from meta.local_encryptor_data.\nfunc DecryptYandexIntermediateKey(masterKey, blob []byte) ([]byte, error) {\n\tidx := bytes.Index(blob, localEncryptorPrefix)\n\tif idx < 0 {\n\t\treturn nil, errYandexMarkerNotFound\n\t}\n\tpayload := blob[idx+len(localEncryptorPrefix):]\n\tif len(payload) < yandexIntKeyBlobLen {\n\t\treturn nil, errYandexBlobShort\n\t}\n\n\tplaintext, err := AESGCMDecryptBlob(masterKey, payload[:yandexIntKeyBlobLen], nil)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif !bytes.HasPrefix(plaintext, yandexSignature) {","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/crypto/yandex.go#L4-L40","documentation":"After stripping the protobuf signature from the decrypted Yandex intermediate-key plaintext, the remainder must contain at least yandexDataKeyLen (32) bytes of key material. If it is shorter, the decrypted key cannot be a valid 32-byte data key, so DecryptYandexIntermediateKey fails rather than returning truncated key bytes.","triggerScenarios":"Calling DecryptYandexIntermediateKey where GCM decryption succeeds and the signature prefix matches, but the remaining plaintext is under 32 bytes — typically a truncated blob or a malformed protobuf body.","commonSituations":"Truncated copy of the Yandex profile database/Local State, slicing the blob short after the marker, or an altered Yandex format that stores fewer payload bytes than expected.","solutions":["Re-copy the Yandex profile files to ensure the blob is not truncated.","Verify the blob slice extends to the end of local_encryptor_data (no premature length cap).","Confirm the Yandex version still wraps a 32-byte data key; adjust yandexDataKeyLen parsing if the format changed.","Retry with a fresh master key to rule out partial decrypts producing malformed plaintext."],"exampleFix":"// before: blob sliced with an arbitrary fixed length\nblob := data[idx+len(localEncryptorPrefix) : idx+len(localEncryptorPrefix)+16]\n// after: take everything after the marker\nblob := data[idx+len(localEncryptorPrefix):]","handlingStrategy":"validation","validationCode":"if len(blob) < 64 { return errors.New(\"yandex blob too short to hold a 32-byte data key\") }","typeGuard":null,"tryCatchPattern":"key, err := DecryptYandexIntermediateKey(masterKey, blob)\nif errors.Is(err, errYandexKeyTooShort) {\n    return nil, fmt.Errorf(\"yandex intermediate key truncated: %w\", err)\n}","preventionTips":["Copy profile files completely before parsing (avoid partial copies).","Take the blob to end-of-data rather than a fixed slice length.","Re-verify file sizes after copying the profile."],"tags":["yandex","decryption","crypto","truncated-data"],"backgroundTag":"value-out-of-range","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}