Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto/rsa: 4096 bit keys are not generated with BoringCrypto [1.20 backport] #58927

Open
gopherbot opened this issue Mar 8, 2023 · 0 comments
Open

crypto/rsa: 4096 bit keys are not generated with BoringCrypto [1.20 backport] #58927

gopherbot opened this issue Mar 8, 2023 · 0 comments
Labels
CherryPickApproved Used during the release process for point releases WaitingForInfo Issue is not actionable because of missing required information, which needs to be provided.
Milestone
Go1.20.3

Comments

@gopherbot
Copy link

@FiloSottile requested issue #58803 to be considered for backport to the next 1.20 minor release.

@gopherbot please open a Go 1.20 backport issue for this.

Go 1.20 updated the BoringCrypto module and started using BoringCrypto for RSA 4096 bit keys in crypto/x509, but not in GenerateKey. The two are not necessarily correlated (most X.509 keys are loaded from disk, not generated) but using unverified crypto unexpectedly is not great, and the fix is simple.

/cc @rsc @golang/security
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label Mar 8, 2023
@gopherbot gopherbot mentioned this issue Mar 8, 2023
Open
@gopherbot gopherbot added this to the Go1.20.3 milestone Mar 8, 2023
@cherrymui cherrymui added the CherryPickApproved Used during the release process for point releases label Mar 15, 2023
@gopherbot gopherbot removed the CherryPickCandidate Used during the release process for point releases label Mar 15, 2023
@heschi heschi added the WaitingForInfo Issue is not actionable because of missing required information, which needs to be provided. label Mar 20, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases WaitingForInfo Issue is not actionable because of missing required information, which needs to be provided.
Projects
None yet
Milestone
Go1.20.3
Development

No branches or pull requests
3 participants
@gopherbot @cherrymui @heschi