Bug 1598708
| Summary: | [RFE] Allow creating IPA CA with 3072-bit key. | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | German Parente <gparente> | ||||
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> | ||||
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 8.1 | CC: | abokovoy, apeddire, b.prins, cheimes, ddas, frenaud, ftweedal, ipa-maint, ksiddiqu, nsoman, pasik, pcech, pvoborni, rcritten, tscherf, twoerner | ||||
| Target Milestone: | rc | Keywords: | FutureFeature | ||||
| Target Release: | 8.1 | Flags: | pm-rhel:
mirror+
|
||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | ipa-4.7.90.pre1-3 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2019-11-05 20:52:26 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
German Parente
2018-07-06 09:19:24 UTC
IPA has increased the default RSA size to 3072bits. That's equivalent to 128 bit symmetric strength and recommended by NIST for usage after 2030. 4096 bit RSA keys would reduce the speed of signature verification to almost half of 3072. Fixed upstream master: https://pagure.io/freeipa/c/45b8cc1d83cde31af53d2cffd3913becc591ad34 https://pagure.io/freeipa/c/00a7868fa4011a0639bf96d23225c4203980bfb3 https://pagure.io/freeipa/c/2bad9fd0df540dd93c7802cc06fbcf1f72f83965 IPA 4.8.0 will create a CA with 3072bit RSA key by default. A key size of 3072 was chosen in accordance with recommendation in NIST SP 800-57 Part 1 Revision 4. A 3072bit RSA key as approximately the same security strength as AES-128 and SHA-256. NIST recommends 3072 for RSA keys that are used beyond 2030. Remark: The ticket originally requested a key size of 4096. We decided to follow the NIST recommendation instead. The security strength of an asymmetric signing algorithm does not scale linear. RSA 2048 is equivalent to a security strengh of 112, 7680bit key to 192, and 15360bit key to 256. Verified. Please find the attached verification-output.txt where manual cert key size is verified. Also executed the upstream test added for this in beta compose build which is working fine. [root@dhcp207-127 ~]# py.test-3.6 -v -r a --color=yes --multihost-config=/"root/mh_cfg.yaml" --junit-xml=/root/junit.xml /usr/lib/python3.6/site-packages/ipatests/test_integration/test_installation.py::TestInstallMaster ================================================================ test session starts ================================================================= platform linux – Python 3.6.8, pytest-3.4.2, py-1.5.3, pluggy-0.6.0 – /usr/libexec/platform-python collected 10 items ../usr/lib/python3.6/site-packages/ipatests/test_integration/test_installation.py::TestInstallMaster::test_pki_certs PASSED [ 70%] [root@dhcp207-127 ~]# rpm -q ipa-server ipa-server-4.7.90.pre1-3.module+el8.1.0+3389+a3c612fa.x86_64 [root@dhcp207-127 ~]# Created attachment 1589396 [details]
verification steps with output
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:3348 |