diff options
| author | Shane Lontis <shane.lontis@oracle.com> | 2020-06-10 08:59:56 +1000 |
|---|---|---|
| committer | Shane Lontis <shane.lontis@oracle.com> | 2020-06-10 08:59:56 +1000 |
| commit | 8bf37709a471bb31d2e1f5b4b3796fb3e6dce4df (patch) | |
| tree | e98500058e4d1c66bec1b7badd759b6c61bab683 /doc | |
| parent | cd4afec69f13e283f74d59f1c97e15db6803bdcb (diff) | |
Update RSA keygen to use sp800-56b by default
Fixes #11742
Fixes #11764
The newer RSA sp800-56b algorithm is being used for the normal case of a non multiprime key of at least length 2048.
Insecure key lengths and mutltiprime RSA will use the old method.
Bad public exponents are no longer allowed (i.e values less than 65537 or even). Values such as 2 that would cause a infinite loop now result in an error. The value of 3 has been marked as deprecated but is still allowed for legacy purposes.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11765)
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/man1/openssl-genrsa.pod.in | 3 | ||||
| -rw-r--r-- | doc/man7/EVP_PKEY-RSA.pod | 6 |
2 files changed, 8 insertions, 1 deletions
diff --git a/doc/man1/openssl-genrsa.pod.in b/doc/man1/openssl-genrsa.pod.in index 89ae929ced..33aa60ca4e 100644 --- a/doc/man1/openssl-genrsa.pod.in +++ b/doc/man1/openssl-genrsa.pod.in @@ -33,7 +33,7 @@ B<openssl> B<genrsa> {- $OpenSSL::safe::opt_provider_synopsis -} [B<numbits>] -=for openssl ifdef engine +=for openssl ifdef engine 3 =head1 DESCRIPTION @@ -70,6 +70,7 @@ for if it is not supplied via the B<-passout> argument. =item B<-F4>, B<-f4>, B<-3> The public exponent to use, either 65537 or 3. The default is 65537. +The B<-3> option has been deprecated. =item B<-primes> I<num> diff --git a/doc/man7/EVP_PKEY-RSA.pod b/doc/man7/EVP_PKEY-RSA.pod index ad49284437..28f61e4066 100644 --- a/doc/man7/EVP_PKEY-RSA.pod +++ b/doc/man7/EVP_PKEY-RSA.pod @@ -123,6 +123,12 @@ default is 2. It isn't permitted to specify a larger number of primes than being generated so the maximum number could be less. Some providers may only support a value of 2. +=item "e" (B<OSSL_PKEY_PARAM_RSA_E>) <unsigned integer> + +The RSA "e" value. The value may be any odd number greater than or equal to +65537. The default value is 65537. +For legacy reasons a value of 3 is currently accepted but is deprecated. + =back =head1 CONFORMING TO |