Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Require minimum key size for RSA keys #854

Closed
lcobucci opened this issue Jul 24, 2022 · 2 comments · Fixed by #855
Closed

Require minimum key size for RSA keys #854

lcobucci opened this issue Jul 24, 2022 · 2 comments · Fixed by #855
Labels
Improvement Minor BC-break Security
Milestone
4.2.0

Comments

@lcobucci
Copy link
Owner

lcobucci commented Jul 24, 2022 •
edited

As stated on JWA 3.3, RSA keys need to be a least 2048 long:

Digital Signature with RSASSA-PKCS1-v1_5

This section defines the use of the RSASSA-PKCS1-v1_5 digital
signature algorithm as defined in Section 8.2 of RFC 3447 [RFC3447]
(commonly known as PKCS #1), using SHA-2 [SHS] hash functions.

A key of size 2048 bits or larger MUST be used with these algorithms.
@lcobucci lcobucci added this to the 4.2.0 milestone Jul 24, 2022
@lcobucci
Copy link
Owner Author

@Slamdunk we missed this one too 😞

@lcobucci lcobucci mentioned this issue Jul 24, 2022
Closed
@lcobucci lcobucci changed the title Verify minimum key size for RSA keys Require minimum key size for RSA keys Jul 24, 2022
@Slamdunk
Copy link
Collaborator

Slamdunk commented Jul 27, 2022 •
edited

Ok.

I see the standard doesn't tell anything about ECDSA keys, but I would like to introduce a minimum key requirement there too, which would be 224 bits to have the same strength of an RSA key length of 2048 bits.

WDYT?

@Slamdunk Slamdunk mentioned this issue Jul 27, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Improvement Minor BC-break Security
Projects
None yet
Milestone
4.2.0
Development

Successfully merging a pull request may close this issue.

Require minimum key size for OpenSSL keys Slamdunk/jwt
2 participants
@Slamdunk @lcobucci