Increase key size to 2048 bits

[basak]

Debian changed the default security level to 2 since openssl package version 1.1.1~~pre9-1 (August 2018), which requires a minimum key size of 2048 bit or larger RSA and DHE keys. To avoid test failures on newer Debian systems against OpenSSL, use a key size of at least 2048 bits.

I guess another approach might be to adjust the way OpenSSL is used to somehow override CipherString in /etc/ssl/openssl.cnf at runtime. I'm not sure how to do that.

This is Debian bug 926652. The build failure is logged here (I'm not sure how long that will be retained for).

I intend to patch Debian with this soon, to allow python-trustme 0.4.0 to make the next Debian release, at least. Please let me know if you think this is the wrong thing to do.

[codecov]

Codecov Report

Merging #45 into master will not change coverage.
The diff coverage is 100%.

@@          Coverage Diff          @@
##           master    #45   +/-   ##
=====================================
  Coverage     100%   100%           
=====================================
  Files           3      3           
  Lines         354    354           
  Branches       23     23           
=====================================
  Hits          354    354

Impacted Files	Coverage Δ
trustme/__init__.py	100% <100%> (ø)	⬆️

[njsmith]

Yeah, I guess we have no choice... on the "my laptop" benchmark, this seems to bump the time to issue a server cert up to 160 ms:

# 1024 bits (current)
In [4]: %timeit trustme.CA().issue_server_cert("localhost")                     
34.6 ms ± 4.97 ms per loop (mean ± std. dev. of 7 runs, 10 loops each)

# 2048 bits (this PR)
In [5]: trustme._KEY_SIZE = 2048                                                

In [6]: %timeit trustme.CA().issue_server_cert("localhost")                     
160 ms ± 11.4 ms per loop (mean ± std. dev. of 7 runs, 10 loops each)

Sad but not too bad. When people start requiring 4096 bit certs then we might need to think if there are any kluges we can do to speed things up...

[njsmith]

I tightened up the comment a bit, directly in your branch.

Can you also add a newsfragment? Just something like newsfragments/45.bugfix.rst with contents Update key size to 2048 bits, as required by recent Debian.

[njsmith]

Thanks! And as per our contribution policy, I'm sending you a github invite now :-)