From 4f4dc6749cbeb13462e438ed39a87744b62a4db8 Mon Sep 17 00:00:00 2001 From: Anton Date: Sun, 29 Jul 2018 01:54:55 +0400 Subject: use randomized RSA key size for account certificates --- pica-client/dialogs/registeraccountdialog.cpp | 3 +-- pica-client/openssltool.cpp | 17 ++++++++++++++++- pica-client/openssltool.h | 2 +- 3 files changed, 18 insertions(+), 4 deletions(-) diff --git a/pica-client/dialogs/registeraccountdialog.cpp b/pica-client/dialogs/registeraccountdialog.cpp index 05a4932..96345b9 100644 --- a/pica-client/dialogs/registeraccountdialog.cpp +++ b/pica-client/dialogs/registeraccountdialog.cpp @@ -17,7 +17,6 @@ */ #include "registeraccountdialog.h" #include "../globals.h" -#include "../../PICA_security.h" #include #include #include @@ -179,7 +178,7 @@ void RegisterAccountDialog::Register() nickname->setEnabled(false); btRegister->setEnabled(false); - ost.GenRSAKeySignal(PICA_RSA_MINKEYSIZE, config_dir + QDir::separator() + "privkey.pem", cbSetPassword->isChecked(), + ost.GenRSAKeySignal(config_dir + QDir::separator() + "privkey.pem", cbSetPassword->isChecked(), password->text(), rand, this, SLOT(stageSignCert(int, QProcess::ExitStatus))); } diff --git a/pica-client/openssltool.cpp b/pica-client/openssltool.cpp index 314dbd5..e630b36 100644 --- a/pica-client/openssltool.cpp +++ b/pica-client/openssltool.cpp @@ -17,6 +17,7 @@ */ #include "openssltool.h" #include "../PICA_security.h" +#include #include #include #include @@ -113,9 +114,11 @@ QString OpenSSLTool::CertTextFromString(QString cert_pem) return QString::fromUtf8(openssl.readAllStandardOutput().constData()); } -bool OpenSSLTool::GenRSAKeySignal(quint32 numbits, QString keyfile, bool setpassword, QString password, QString rand, QObject *receiver, const char *finished_slot) +bool OpenSSLTool::GenRSAKeySignal(QString keyfile, bool setpassword, QString password, QString rand, QObject *receiver, const char *finished_slot) { QStringList args; + quint32 numbits; + unsigned char rndchar; args << "genrsa" << "-out" << keyfile; @@ -125,6 +128,18 @@ bool OpenSSLTool::GenRSAKeySignal(quint32 numbits, QString keyfile, bool setpass if (!rand.isEmpty()) args << "-rand" << rand; + /* + * Generate random-sized key with min size 4096 and multiply of 8. + * Max size is limited to 4096 + 99*8. + * See https://blog.josefsson.org/2016/11/03/why-i-dont-use-2048-or-4096-rsa-key-sizes/ + * "Why I don’t Use 2048 or 4096 RSA Key Sizes" + */ + numbits = PICA_RSA_MINKEYSIZE; + + RAND_pseudo_bytes(&rndchar, 1); + + numbits += 8 * (rndchar % 100); + args << QString::number(numbits); openssl_.start("openssl", args); diff --git a/pica-client/openssltool.h b/pica-client/openssltool.h index c8776a7..809dcf5 100644 --- a/pica-client/openssltool.h +++ b/pica-client/openssltool.h @@ -30,7 +30,7 @@ public: static QString NameFromCertString(QString cert_pem); static QString CertTextFromString(QString cert_pem); - bool GenRSAKeySignal(quint32 numbits, QString keyfile, bool setpassword, + bool GenRSAKeySignal(QString keyfile, bool setpassword, QString password, QString rand, QObject *receiver, const char *finished_slot); bool GenCertSignal(QString cert_file, QString keyfile, QString keypassword, QString subject, QObject *receiver, const char *finished_slot); -- cgit v1.2.1