Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[DocDB] Unit test key/certificate pairs should use 2048+ bits for RSA private keys #20370

Closed
1 task done
es1024 opened this issue Dec 21, 2023 · 0 comments
Closed
1 task done

[DocDB] Unit test key/certificate pairs should use 2048+ bits for RSA private keys #20370

es1024 opened this issue Dec 21, 2023 · 0 comments
Assignees
@es1024
Labels
area/docdb YugabyteDB core features kind/enhancement This is an enhancement of an existing feature priority/medium Medium priority issue

Comments

@es1024
Copy link
Contributor

es1024 commented Dec 21, 2023 •
edited by jira bot

Jira Link: DB-9363

Description

We currently use 1024-bit RSA private keys for key/certificate pairs for unit tests, but FIPS 140-2 requires a minimum of 2048 bits for RSA keys, resulting in TLS unit tests being unable to run when the OpenSSL FIPS provider is used. These keys should be changed to be 2048 bits.

Issue Type

kind/enhancement

Warning: Please confirm that this issue does not contain any sensitive information

  • I confirm this issue does not contain any sensitive information.
@es1024 es1024 added area/docdb YugabyteDB core features status/awaiting-triage Issue awaiting triage labels Dec 21, 2023
@es1024 es1024 self-assigned this Dec 21, 2023
@yugabyte-ci yugabyte-ci added kind/enhancement This is an enhancement of an existing feature priority/medium Medium priority issue and removed status/awaiting-triage Issue awaiting triage labels Dec 21, 2023
es1024 added a commit that referenced this issue Jan 19, 2024
@es1024
[#20370] docdb: Use 2048-bit RSA keys for unit test key/certificate p…
eb54e83 
…airs

Summary:
Unit tests currently use 1024-bit RSA keys, but FIPS 140-2 requires 2048-bit or higher keys for RSA, so the existing keys/certificates are unusable when the OpenSSL FIPS provider is used. This diff updates the keys to be 2048-bit.

This diff also moves generation of keys and certificates for unit tests from being an adhoc process to being part of the build.
Jira: DB-9363

Test Plan: Jenkins

Reviewers: mbautin

Reviewed By: mbautin

Subscribers: rthallam, ybase

Differential Revision: https://phorge.dev.yugabyte.com/D31282
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@es1024 es1024

Labels
area/docdb YugabyteDB core features kind/enhancement This is an enhancement of an existing feature priority/medium Medium priority issue
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@es1024 @rthallamko3 @yugabyte-ci