From 925df8198bb6170f921fc9b920f1fcac77106044 Mon Sep 17 00:00:00 2001 From: Mubashir Osmani Date: Fri, 10 Jul 2026 21:50:05 +0000 Subject: [PATCH] fix(proxy): use 128-bit GCM tag and salt for password.link encryption Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- litellm/proxy/management_helpers/password_link_share.py | 4 ++-- .../proxy/management_helpers/test_password_link_share.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/litellm/proxy/management_helpers/password_link_share.py b/litellm/proxy/management_helpers/password_link_share.py index ec75dea7b64..b79b790a15b 100644 --- a/litellm/proxy/management_helpers/password_link_share.py +++ b/litellm/proxy/management_helpers/password_link_share.py @@ -14,8 +14,8 @@ _PASSWORD_PART_LENGTH = 18 _PBKDF2_ITERATIONS = 10000 _DERIVED_KEY_BYTES = 32 _GCM_IV_BYTES = 16 -_GCM_SALT_BYTES = 8 -_GCM_TAG_BYTES = 8 +_GCM_SALT_BYTES = 16 +_GCM_TAG_BYTES = 16 _KEY_SIZE_BITS = 256 _PART_ALPHABET = string.ascii_letters + string.digits _DEFAULT_API_BASE = "https://password.link" diff --git a/tests/test_litellm/proxy/management_helpers/test_password_link_share.py b/tests/test_litellm/proxy/management_helpers/test_password_link_share.py index 3aaa4201b2d..aa84c45f008 100644 --- a/tests/test_litellm/proxy/management_helpers/test_password_link_share.py +++ b/tests/test_litellm/proxy/management_helpers/test_password_link_share.py @@ -89,7 +89,7 @@ async def test_creates_decryptable_one_time_link() -> None: assert parsed["mode"] == "gcm" assert parsed["ks"] == 256 assert parsed["iter"] == 10000 - assert parsed["ts"] == 64 + assert parsed["ts"] == 128 @pytest.mark.asyncio