From a7e99d52f541ecca1a314d894e65341bbe79ca24 Mon Sep 17 00:00:00 2001
From: Surma <surma@surma.dev>
Date: Fri, 6 Nov 2026 19:29:35 +0000
Subject: [PATCH] cred: reject non-32-byte raw ES256 scalars

---
 host/src/cred/keys.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/host/src/cred/keys.rs b/host/src/cred/keys.rs
index b19d814..78dee7e 100644
--- a/host/src/cred/keys.rs
+++ b/host/src/cred/keys.rs
@@ -141,7 +141,7 @@ pub(super) fn read(value: &str, format: &str, passphrase: Option<&str>) -> Resul
             "ed25519" => Key::Ed(SigningKey::from_bytes(
                 bytes.as_slice().try_into().map_err(|_| invalid_key())?,
             )),
-            "es256" => {
+            "es256" if bytes.len() == 32 => {
                 Key::Ec(p256::ecdsa::SigningKey::from_slice(&bytes).map_err(|_| invalid_key())?)
             }
             "hmac" => Key::Mac(bytes),