key_material changes

[diogomonica]

This is not an issue, but I propose to change the following on key_material:

• change the modulus_bits=2048 (to set 2048 bits as default)
• Add the following two methods: save_keys and load_keys:

def save_keys(file,password) File.open(file, 'w') {|f| f.write(self.keypair.to_pem(OpenSSL::Cipher.new("AES-256-CBC"),password)) } end

def load_keys(file,password) self.keypair = OpenSSL::PKey::RSA.new(File.read(file), password) self.private_key = keypair self.public_key = keypair.public_key self.keypair end

[cchandler]

I had a longer-term plan in place to increase the size of the modulus to 2048, but first I need to revisit the test suite and specifically pass 1024 in any case I need to generate a key, otherwise it makes autotesting a pain.

I want to take a filtered approach to handling key management. I could see doing something like a FileFilter class/module that you can include if you want that kind of functionality. The problem with adding it to the class like that is it leads to inconsistent structure between wrapped keys, unwrapped keys, and hardware keys. Right now, if in doubt, I use the hardware keys as the standard behavior.

It also leads to problems in maintaining the passwords in memory and whether or not once the key is unwrapped, does it remain unwrapped.

[cchandler]

Part one of this has been addressed in https://github.com/cchandler/certificate_authority/commit/62ab6f512defd3f6a247d3dfa5ecd71968331c89

I'll give some filter-like patterns some thought on saving key materials

[cchandler]

The modulus has been configurable for a while and I believe @sul3n3t added load-from-cert capability.