diff options
Diffstat (limited to 'pica-client/openssltool.cpp')
| -rw-r--r-- | pica-client/openssltool.cpp | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/pica-client/openssltool.cpp b/pica-client/openssltool.cpp index 314dbd5..e630b36 100644 --- a/pica-client/openssltool.cpp +++ b/pica-client/openssltool.cpp @@ -17,6 +17,7 @@ */ #include "openssltool.h" #include "../PICA_security.h" +#include <openssl/rand.h> #include <QProcess> #include <QRegExp> #include <QMessageBox> @@ -113,9 +114,11 @@ QString OpenSSLTool::CertTextFromString(QString cert_pem) return QString::fromUtf8(openssl.readAllStandardOutput().constData()); } -bool OpenSSLTool::GenRSAKeySignal(quint32 numbits, QString keyfile, bool setpassword, QString password, QString rand, QObject *receiver, const char *finished_slot) +bool OpenSSLTool::GenRSAKeySignal(QString keyfile, bool setpassword, QString password, QString rand, QObject *receiver, const char *finished_slot) { QStringList args; + quint32 numbits; + unsigned char rndchar; args << "genrsa" << "-out" << keyfile; @@ -125,6 +128,18 @@ bool OpenSSLTool::GenRSAKeySignal(quint32 numbits, QString keyfile, bool setpass if (!rand.isEmpty()) args << "-rand" << rand; + /* + * Generate random-sized key with min size 4096 and multiply of 8. + * Max size is limited to 4096 + 99*8. + * See https://blog.josefsson.org/2016/11/03/why-i-dont-use-2048-or-4096-rsa-key-sizes/ + * "Why I don’t Use 2048 or 4096 RSA Key Sizes" + */ + numbits = PICA_RSA_MINKEYSIZE; + + RAND_pseudo_bytes(&rndchar, 1); + + numbits += 8 * (rndchar % 100); + args << QString::number(numbits); openssl_.start("openssl", args); |