From 0336df2fa316a3e08b8f0d2d0e8d4bc175e46634 Mon Sep 17 00:00:00 2001 From: Georg Schmidt Date: Thu, 31 May 2018 01:42:39 +0200 Subject: Issue warnings for large DSA and RSA keys Issue a warning when generating DSA or RSA keys of size greater than OPENSSL_DSA_MAX_MODULUS_BITS resp. OPENSSL_RSA_MAX_MODULUS_BITS. Reviewed-by: Paul Dale Reviewed-by: Rich Salz Reviewed-by: Matthias St. Pierre (Merged from https://github.com/openssl/openssl/pull/6380) --- apps/req.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'apps/req.c') diff --git a/apps/req.c b/apps/req.c index ca4b7ec891..59baa89bcf 100644 --- a/apps/req.c +++ b/apps/req.c @@ -517,6 +517,18 @@ int req_main(int argc, char **argv) goto end; } + if (pkey_type == EVP_PKEY_RSA && newkey > OPENSSL_RSA_MAX_MODULUS_BITS) + BIO_printf(bio_err, + "Warning: It is not recommended to use more than %d bit for RSA keys.\n" + " Your key size is %ld! Larger key size may behave not as expected.\n", + OPENSSL_RSA_MAX_MODULUS_BITS, newkey); + + if (pkey_type == EVP_PKEY_DSA && newkey > OPENSSL_DSA_MAX_MODULUS_BITS) + BIO_printf(bio_err, + "Warning: It is not recommended to use more than %d bit for DSA keys.\n" + " Your key size is %ld! Larger key size may behave not as expected.\n", + OPENSSL_DSA_MAX_MODULUS_BITS, newkey); + if (genctx == NULL) { genctx = set_keygen_ctx(NULL, &pkey_type, &newkey, &keyalgstr, gen_eng); -- cgit v1.2.3