limbo: add RSA key size tests #184
Conversation
Signed-off-by: William Woodruff <william@trailofbits.com>
limbo/testcases/webpki/__init__.py
Outdated
| below the security margin (2048) required under CABF 6.1.5. | ||
| """ | ||
|
|
||
| root_key = rsa.generate_private_key(65537, 1024) |
There was a problem hiding this comment.
strongly suggest making these kwargs for readability
|
Right now these are tests of the EE key size, which are not used in validation. Should there be, in either in addition or instead of, tests for weak keys that are used to validate signatures? |
I think you got this flipped (unless I completely mis-wrote these): the current tests are for weak RSA keys on certificate signatures, but I need to add some more tests for weak RSA keys in EE certs. |
|
yup, total brain fart. weak keys in EE are a bit different and should be handled in a seperate PR |
This adds two RSA key tests: one for small RSA keys (forbidden under CABF), and one for keys that aren't divisible by 8 (forbidden under CABF, but universally ignored).