security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-01-18 14:17:03 +01:00
Code Activity

Limit keysize for unattended key generation to useful values.

Browse Source 
* g10/keygen.c (gen_elg): Enforce keysize 1024 to 4096.
(gen_rsa): Enforce keysize 1024 to 4096.
(gen_dsa): Enforce keysize 768 to 3072.
--

It was possible to create 16k RSA keys in batch mode. In addition to
the silliness of such keys, they have the major drawback that GnuPG,
with its limited amount of specially secured memory areas, the use of
such keys may lead to an "out of secure memory" condition.
This commit is contained in:
Werner Koch 2014-06-25 20:25:28 +02:00
parent 955524f435
commit aae7ec516b
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
g10/keygen.c
View File

@ -1039,10 +1039,14 @@ gen_elg(int algo, unsigned nbits, KBNODE pub_root, KBNODE sec_root, DEK *dek,
assert( is_ELGAMAL(algo) );
if( nbits < 512 ) {
if (nbits < 1024) {
nbits = 2048;
log_info(_("keysize invalid; using %u bits\n"), nbits );
}
else if (nbits > 4096) {
nbits = 4096;
log_info(_("keysize invalid; using %u bits\n"), nbits );
}
if( (nbits % 32) ) {
nbits = ((nbits + 31) / 32) * 32;
@ -1121,7 +1125,7 @@ gen_dsa(unsigned int nbits, KBNODE pub_root, KBNODE sec_root, DEK *dek,
MPI *factors;
unsigned int qbits;
if( nbits < 512)
if( nbits < 768)
{
nbits = 2048;
log_info(_("keysize invalid; using %u bits\n"), nbits );
@ -1256,6 +1260,10 @@ gen_rsa(int algo, unsigned nbits, KBNODE pub_root, KBNODE sec_root, DEK *dek,
nbits = 2048;
log_info(_("keysize invalid; using %u bits\n"), nbits );
}
else if (nbits > 4096) {
nbits = 4096;
log_info(_("keysize invalid; using %u bits\n"), nbits );
}
if( (nbits % 32) ) {
nbits = ((nbits + 31) / 32) * 32;