# Length for tailf:aes-cfb-128-encrypted-string type

**URL:** <https://dmap-community.ductus.global/t/length-for-tailf-aes-cfb-128-encrypted-string-type/632>\
**Category:** YANG\
**Created:** [August 14, 2016, 11:01am UTC](https://dmap-community.ductus.global/t/length-for-tailf-aes-cfb-128-encrypted-string-type/632 "2016-08-14T11:01:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![yogevc](https://avatars.discourse-cdn.com/v4/letter/y/8491ac/32.png) [@yogevc](https://dmap-community.ductus.global/u/yogevc)\
**Post date:** [August 14, 2016, 11:01am UTC](https://dmap-community.ductus.global/t/length-for-tailf-aes-cfb-128-encrypted-string-type/632/1 "2016-08-14T11:01:12Z")

</div>

I’m trying to add the `length` directive to the type `tailf:aes-cfb-128-encrypted-string`.  
Seems like the leaf ignores the length.

```
leaf key {
    type tailf:aes-cfb-128-encrypted-string {
        length "8..12";
        }
}

```

When I commit a string with a length lower than 8, the commit suceeds.

I saw this in the `man 3 confd_types`:

```
tailf:aes-cfb-128-encrypted-string
       The aes-cfb-128-encrypted-string works exactly like des3-cbc-encrypted-string but AES/128bits in CFB mode is used to encrypt the string. The prefix for encrypted values is "$8$".

           Note
           The pattern restriction can not be used with this type.

```

There’s nothing written about the `length` restriction.

Am I doing something wrong?  
Thanks.

---

<div class="post-metadata">

**Author:** ![waitai](https://yyz2.discourse-cdn.com/flex010/user_avatar/dmap-community.ductus.global/waitai/32/436_2.png) [@waitai](https://dmap-community.ductus.global/u/waitai)\
**Post date:** [August 15, 2016, 5:11pm UTC](https://dmap-community.ductus.global/t/length-for-tailf-aes-cfb-128-encrypted-string-type/632/2 "2016-08-15T17:11:26Z")

</div>

> [@yogevc](#):
>
> leaf key {  
> type tailf:aes-cfb-128-encrypted-string {  
> length “8…12”;  
> }  
> }

The length restriction in the above YANG statements applies to the encrypted form of the leaf value including the prefix with the enclosed ‘$’ signs. The ciphertext can be significantly longer then the cleartext due to the padding to make it multiple of 16 bytes prior to encryption and the encryption itself followed by base64 encoding. What you can do in this case is to restrict the length of this encrypted string data type in cleartext format using a validation callpoint.