embassy-rs/embassy · error

Passphrase is too short or too long

Error message

Passphrase is too short or too long

What it means

cyw43's `start_ap` panics when the AP passphrase length is outside the WPA PSK limits: shorter than MIN_PSK_LEN (8) or longer than MAX_PSK_LEN (64). WPA/WPA2/WPA3 PSKs must be 8-64 bytes per the 802.11 standard, so the driver rejects invalid lengths eagerly instead of failing in firmware. Open APs are exempt because no passphrase is used.

Solutions

1. Ensure the passphrase is between 8 and 64 bytes long before calling start_ap
2. If you want no password, pass `ApAuth::Open` instead of a short passphrase
3. Derive a PSK from longer user input (e.g. hash it) when users supply arbitrary passwords
4. Clamp or reject user-supplied SSID/passphrase input in your application config layer before reaching the driver

Example fix

// before
control.start_ap("myssid", "short", ApAuth::Wpa2, 6).await;
// after
let passphrase = "correct-horse-battery"; // 8..=64 bytes
control.start_ap("myssid", passphrase, ApAuth::Wpa2, 6).await;

const MIN_PSK_LEN: usize = 8;
const MAX_PSK_LEN: usize = 64;
fn valid_ap_passphrase(pass: &str, auth: ApAuth) -> bool {
    if auth == ApAuth::Open { return true; }
    let n = pass.as_bytes().len();
    (MIN_PSK_LEN..=MAX_PSK_LEN).contains(&n)
}
// call: assert!(valid_ap_passphrase(pass, auth), "passphrase must be 8..=64 bytes");

fn is_open_auth(auth: ApAuth) -> bool { matches!(auth, ApAuth::Open) }

When it happens

Trigger: Calling `Control::start_ap` (directly or via `start_ap_open`-style wrappers passing auth != ApAuth::Open) with a passphrase shorter than 8 characters or longer than 64 bytes. Only checked when `auth` is not `ApAuth::Open`.

Common situations: Hardcoding a short test password like "12345" for a WPA2 access point; passing an empty string while meaning an open AP but supplying Wpa2; generating a 64+ byte key by encoding raw 32-byte material as longer hex; firmware migration where an older driver silently accepted short keys.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• heartbeat from esp32 stopped
• Boot prepare error
• Boot prepare error
• Boot prepare error
• The read size for the concatenated flashes must be the same

AI-assisted analysis of embassy-rs/embassy@463a07b963 (2026-09-10). Data as JSON: /api/errors/72d98aadcd020fde. Report an issue: GitHub.

Appendix: source

Thrown at cyw43/src/control.rs:488

    ///
    /// Requires compatible CYW43 firmware and client support.
    pub async fn start_ap_wpa3(&mut self, ssid: &str, passphrase: &str, channel: u8) {
        self.start_ap(ssid, passphrase, ApAuth::Wpa3, channel).await;
    }

    /// Start WPA2/WPA3 transition mode access point.
    ///
    /// WPA3 requires compatible CYW43 firmware and client support.
    pub async fn start_ap_wpa2_wpa3(&mut self, ssid: &str, passphrase: &str, channel: u8) {
        self.start_ap(ssid, passphrase, ApAuth::Wpa2Wpa3, channel).await;
    }

    /// Start an access point with the specified authentication type.
    ///
    /// WPA3 requires compatible CYW43 firmware and client support.
    pub async fn start_ap(&mut self, ssid: &str, passphrase: &str, auth: ApAuth, channel: u8) {
        if auth != ApAuth::Open && (passphrase.len() < MIN_PSK_LEN || passphrase.len() > MAX_PSK_LEN) {
            panic!("Passphrase is too short or too long");
        }

        let (security, mfp, wpa_auth) = match auth {
            ApAuth::Open => (Security::OPEN, MFP_NONE, WPA_AUTH_DISABLED),
            ApAuth::Wpa2 => (Security::WPA2_AES_PSK, MFP_NONE, WPA_AUTH_WPA2_PSK | WPA_AUTH_WPA_PSK),
            ApAuth::Wpa3 => (Security::WPA3_SAE, MFP_REQUIRED, WPA_AUTH_WPA3_SAE_PSK),
            ApAuth::Wpa2Wpa3 => (
                Security::WPA3_WPA2_PSK,
                MFP_CAPABLE,
                WPA_AUTH_WPA2_PSK | WPA_AUTH_WPA3_SAE_PSK,
            ),
        };

        // Temporarily set wifi down
        self.down().await;

        // Turn off APSTA mode
        self.set_iovar_u32("apsta", 0).await;

View on GitHub (pinned to 463a07b963)