crowdsecurity/crowdsec · error

passphrase master secret is %d bytes; minimum is %d

Error message

passphrase master secret is %d bytes; minimum is %d

What it means

ParseConfiguredSecret treats a non-hex master_secret as a passphrase and rejects it when its byte length is under minSecretBytes. The passphrase is used directly as key material, so it must be long enough to resist brute force.

Source

Thrown at pkg/appsec/challenge/secret.go:54

func ParseConfiguredSecret(value string) ([]byte, error) {
	if value == "" {
		return nil, errors.New("empty master secret")
	}

	// Hex form: even length, hex digits only.
	if isHex(value) {
		raw, err := hex.DecodeString(value)
		if err == nil {
			if len(raw) < minSecretBytes {
				return nil, fmt.Errorf("hex master secret decodes to %d bytes; minimum is %d", len(raw), minSecretBytes)
			}
			return raw, nil
		}
		// Fall through to passphrase handling on hex parse failure — defensive.
	}

	if len(value) < minSecretBytes {
		return nil, fmt.Errorf("passphrase master secret is %d bytes; minimum is %d", len(value), minSecretBytes)
	}

	return []byte(value), nil
}

func isHex(s string) bool {
	if s == "" || len(s)%2 != 0 {
		return false
	}
	for i := range len(s) {
		c := s[i]
		switch {
		case c >= '0' && c <= '9':
		case c >= 'a' && c <= 'f':
		case c >= 'A' && c <= 'F':
		default:
			return false
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Use a passphrase of at least minSecretBytes bytes (e.g. a long diceware phrase or `openssl rand -base64 32`)
2. Prefer the hex form: `openssl rand -hex 32`
3. Verify the deployed config value actually reaches the process intact (quotes, whitespace, env interpolation)
4. Ensure all distributed instances share the corrected full-length secret

Example fix

# before
master_secret: "changeme"
# after
master_secret: "correct horse battery staple gravy ledger nine violet"

if !isHex(cfg.MasterSecret) && len(cfg.MasterSecret) < 32 {
    return fmt.Errorf("master_secret passphrase must be at least 32 bytes")
}

When it happens

Trigger: BuildOptions parses a master_secret that is not valid hex and whose raw string length is below minSecretBytes — e.g. `master_secret: "hunter2"`.

Common situations: Operators picking a short memorable passphrase; YAML-truncated or quoted strings losing characters; secrets from templating that expanded to shorter values; test cases like TestParseConfiguredSecret_PassphraseTooShort.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• keyring master secret is %d bytes; minimum is %d
• hex master secret decodes to %d bytes; minimum is %d
• missing lapi client credentials
• no appsec_config provided
• missing TLS key file

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/a8e005475e8a68b8. Report an issue: GitHub.