From 4f4dc6749cbeb13462e438ed39a87744b62a4db8 Mon Sep 17 00:00:00 2001 From: Anton Date: Sun, 29 Jul 2018 01:54:55 +0400 Subject: use randomized RSA key size for account certificates --- pica-client/openssltool.cpp | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) (limited to 'pica-client/openssltool.cpp') diff --git a/pica-client/openssltool.cpp b/pica-client/openssltool.cpp index 314dbd5..e630b36 100644 --- a/pica-client/openssltool.cpp +++ b/pica-client/openssltool.cpp @@ -17,6 +17,7 @@ */ #include "openssltool.h" #include "../PICA_security.h" +#include #include #include #include @@ -113,9 +114,11 @@ QString OpenSSLTool::CertTextFromString(QString cert_pem) return QString::fromUtf8(openssl.readAllStandardOutput().constData()); } -bool OpenSSLTool::GenRSAKeySignal(quint32 numbits, QString keyfile, bool setpassword, QString password, QString rand, QObject *receiver, const char *finished_slot) +bool OpenSSLTool::GenRSAKeySignal(QString keyfile, bool setpassword, QString password, QString rand, QObject *receiver, const char *finished_slot) { QStringList args; + quint32 numbits; + unsigned char rndchar; args << "genrsa" << "-out" << keyfile; @@ -125,6 +128,18 @@ bool OpenSSLTool::GenRSAKeySignal(quint32 numbits, QString keyfile, bool setpass if (!rand.isEmpty()) args << "-rand" << rand; + /* + * Generate random-sized key with min size 4096 and multiply of 8. + * Max size is limited to 4096 + 99*8. + * See https://blog.josefsson.org/2016/11/03/why-i-dont-use-2048-or-4096-rsa-key-sizes/ + * "Why I don’t Use 2048 or 4096 RSA Key Sizes" + */ + numbits = PICA_RSA_MINKEYSIZE; + + RAND_pseudo_bytes(&rndchar, 1); + + numbits += 8 * (rndchar % 100); + args << QString::number(numbits); openssl_.start("openssl", args); -- cgit v1.2.1