Closed cipherboy closed 2 years ago
cc @golang/security
Related to #41147
Notably, the new info over that ticket (sorry for the duplicate!) is that we don't need to restrict to 4096 and we don't need a new cert; the existing cert is fine per our lab.
Hi @cipherboy, since #41147 already contains additional context for this, could you post your rational for why this change can be made there, and we can continue the discussion. Thanks!
What version of Go are you using (
go version
)?Does this issue reproduce with the latest release?
Yes: https://github.com/golang/go/blob/master/src/crypto/x509/boring.go#L24
What operating system and processor architecture are you using (
go env
)?Linux/amd64.
go env
OutputWhat did you do?
Attempt to use a larger RSA key (e.g., 4096 bits) in a TLS connection.
What did you expect to see?
Success. Per Hashicorp's recent discussions with Leidos around a Letter of Attestation for Vault based on BoringCrypto's 3678 certificate, larger key sizes are allowed. In particular, this limitation shouldn't be necessary as, per our lab contact (and with permission to quote in the interest of getting this change upstreamed):
P. said:
Since the relevant BC certificate has both 2048 and 3072 tested, we sould simplify the check to
>= 2048
.Let me know if this is agreeable and I can open a PR.
What did you see instead?
Failure. :-)