Review corrections for KeepassXC support

[szszszsz]

Review corrections for KeepassXC support #64.

In the end the unpadding crate was used without modifications - it does not matter in this case, as payload bigger than 63 bytes can't be used anyway.

[sosthene-nitrokey]

It doesn't look to me like the Kind/Algorithm matching is actually checked?

CredentialFlat::try_from does not appear to check the max lengh of the secret, or that the algorithm is Sha1:

CredentialData::HmacData(data) => {
    cred.kind = Kind::Hmac;
    cred.secret = ShortData::from_slice(data.secret)?;
    cred.algorithm = data.algorithm;
}

[szszszsz]

CredentialFlat is meant to be a simple struct for data serialization. All checks should be done on construction in the upstream. The check for the secret length and Algo kind is done here:

trussed-secrets-app/src/command.rs

Lines 512 to 532 in 43ee41c

	pub fn try_from(algorithm: oath::Algorithm, secret: &'l [u8]) -> Result<Self, ()> {
	const SHA1_SECRET_EXPECTED_SIZE: usize = 20;
	// Currently only SHA1 is supported, hence the expected SECRET length
	if !(secret.len() == SHA1_SECRET_EXPECTED_SIZE && algorithm == oath::Algorithm::Sha1) {
	return Err(());
	}
	Ok(Self { algorithm, secret })
	}
	}
	#[derive(Clone, Copy, Eq, PartialEq, Debug)]
	pub struct PasswordSafeData<'l> {
	pub login: &'l [u8],
	pub password: &'l [u8],
	pub metadata: &'l [u8],
	}
	impl<'l> PasswordSafeData<'l> {
	pub fn non_empty(&self) -> bool {
	!self.login.is_empty() || !self.password.is_empty() || !self.metadata.is_empty()
	}

[sosthene-nitrokey]

Ok, I missed it sorry.