diff options
| -rw-r--r-- | pica-client/dialogs/registeraccountdialog.cpp | 3 | ||||
| -rw-r--r-- | pica-client/openssltool.cpp | 17 | ||||
| -rw-r--r-- | pica-client/openssltool.h | 2 |
3 files changed, 18 insertions, 4 deletions
diff --git a/pica-client/dialogs/registeraccountdialog.cpp b/pica-client/dialogs/registeraccountdialog.cpp index 05a4932..96345b9 100644 --- a/pica-client/dialogs/registeraccountdialog.cpp +++ b/pica-client/dialogs/registeraccountdialog.cpp @@ -17,7 +17,6 @@ */ #include "registeraccountdialog.h" #include "../globals.h" -#include "../../PICA_security.h" #include <QVBoxLayout> #include <QDir> #include <QFile> @@ -179,7 +178,7 @@ void RegisterAccountDialog::Register() nickname->setEnabled(false); btRegister->setEnabled(false); - ost.GenRSAKeySignal(PICA_RSA_MINKEYSIZE, config_dir + QDir::separator() + "privkey.pem", cbSetPassword->isChecked(), + ost.GenRSAKeySignal(config_dir + QDir::separator() + "privkey.pem", cbSetPassword->isChecked(), password->text(), rand, this, SLOT(stageSignCert(int, QProcess::ExitStatus))); } diff --git a/pica-client/openssltool.cpp b/pica-client/openssltool.cpp index 314dbd5..e630b36 100644 --- a/pica-client/openssltool.cpp +++ b/pica-client/openssltool.cpp @@ -17,6 +17,7 @@ */ #include "openssltool.h" #include "../PICA_security.h" +#include <openssl/rand.h> #include <QProcess> #include <QRegExp> #include <QMessageBox> @@ -113,9 +114,11 @@ QString OpenSSLTool::CertTextFromString(QString cert_pem) return QString::fromUtf8(openssl.readAllStandardOutput().constData()); } -bool OpenSSLTool::GenRSAKeySignal(quint32 numbits, QString keyfile, bool setpassword, QString password, QString rand, QObject *receiver, const char *finished_slot) +bool OpenSSLTool::GenRSAKeySignal(QString keyfile, bool setpassword, QString password, QString rand, QObject *receiver, const char *finished_slot) { QStringList args; + quint32 numbits; + unsigned char rndchar; args << "genrsa" << "-out" << keyfile; @@ -125,6 +128,18 @@ bool OpenSSLTool::GenRSAKeySignal(quint32 numbits, QString keyfile, bool setpass if (!rand.isEmpty()) args << "-rand" << rand; + /* + * Generate random-sized key with min size 4096 and multiply of 8. + * Max size is limited to 4096 + 99*8. + * See https://blog.josefsson.org/2016/11/03/why-i-dont-use-2048-or-4096-rsa-key-sizes/ + * "Why I don’t Use 2048 or 4096 RSA Key Sizes" + */ + numbits = PICA_RSA_MINKEYSIZE; + + RAND_pseudo_bytes(&rndchar, 1); + + numbits += 8 * (rndchar % 100); + args << QString::number(numbits); openssl_.start("openssl", args); diff --git a/pica-client/openssltool.h b/pica-client/openssltool.h index c8776a7..809dcf5 100644 --- a/pica-client/openssltool.h +++ b/pica-client/openssltool.h @@ -30,7 +30,7 @@ public: static QString NameFromCertString(QString cert_pem); static QString CertTextFromString(QString cert_pem); - bool GenRSAKeySignal(quint32 numbits, QString keyfile, bool setpassword, + bool GenRSAKeySignal(QString keyfile, bool setpassword, QString password, QString rand, QObject *receiver, const char *finished_slot); bool GenCertSignal(QString cert_file, QString keyfile, QString keypassword, QString subject, QObject *receiver, const char *finished_slot); |