diff options
| author | Shane Lontis <shane.lontis@oracle.com> | 2020-06-10 08:59:56 +1000 |
|---|---|---|
| committer | Shane Lontis <shane.lontis@oracle.com> | 2020-06-10 08:59:56 +1000 |
| commit | 8bf37709a471bb31d2e1f5b4b3796fb3e6dce4df (patch) | |
| tree | e98500058e4d1c66bec1b7badd759b6c61bab683 /apps/genrsa.c | |
| parent | cd4afec69f13e283f74d59f1c97e15db6803bdcb (diff) | |
Update RSA keygen to use sp800-56b by default
Fixes #11742
Fixes #11764
The newer RSA sp800-56b algorithm is being used for the normal case of a non multiprime key of at least length 2048.
Insecure key lengths and mutltiprime RSA will use the old method.
Bad public exponents are no longer allowed (i.e values less than 65537 or even). Values such as 2 that would cause a infinite loop now result in an error. The value of 3 has been marked as deprecated but is still allowed for legacy purposes.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11765)
Diffstat (limited to 'apps/genrsa.c')
| -rw-r--r-- | apps/genrsa.c | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/apps/genrsa.c b/apps/genrsa.c index 44ce42880c..9a9130125e 100644 --- a/apps/genrsa.c +++ b/apps/genrsa.c @@ -33,7 +33,10 @@ static int genrsa_cb(EVP_PKEY_CTX *ctx); typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, - OPT_3, OPT_F4, OPT_ENGINE, +#ifndef OPENSSL_NO_DEPRECATED_3_0 + OPT_3, +#endif + OPT_F4, OPT_ENGINE, OPT_OUT, OPT_PASSOUT, OPT_CIPHER, OPT_PRIMES, OPT_VERBOSE, OPT_R_ENUM, OPT_PROV_ENUM } OPTION_CHOICE; @@ -48,9 +51,11 @@ const OPTIONS genrsa_options[] = { #endif OPT_SECTION("Input"), - {"3", OPT_3, '-', "Use 3 for the E value"}, - {"F4", OPT_F4, '-', "Use F4 (0x10001) for the E value"}, - {"f4", OPT_F4, '-', "Use F4 (0x10001) for the E value"}, +#ifndef OPENSSL_NO_DEPRECATED_3_0 + {"3", OPT_3, '-', "(deprecated) Use 3 for the E value"}, +#endif + {"F4", OPT_F4, '-', "Use the Fermat number F4 (0x10001) for the E value"}, + {"f4", OPT_F4, '-', "Use the Fermat number F4 (0x10001) for the E value"}, OPT_SECTION("Output"), {"out", OPT_OUT, '>', "Output the key to specified file"}, @@ -100,9 +105,11 @@ opthelp: ret = 0; opt_help(genrsa_options); goto end; +#ifndef OPENSSL_NO_DEPRECATED_3_0 case OPT_3: f4 = RSA_3; break; +#endif case OPT_F4: f4 = RSA_F4; break; |