openlawlibrary / taf

The Archive Framework
GNU Affero General Public License v3.0
10 stars 10 forks source link

feat: remove 2048-bit restriction for yubikey sizes #494

Closed ronantakizawa closed 3 months ago

ronantakizawa commented 3 months ago

Description (e.g. "Related to ...", etc.)

Remove 2048-bit restriction for key sizes. See #446

Code review checklist (for code reviewer to complete)

ronantakizawa commented 3 months ago

Users can set their own key size via CLI (taf yubikey setup-signing-key --key-size 2048), but it currently only supports 1024 and 2048-bit keys.

Based on this article:https://github.com/Yubico/yubico-piv-tool/issues/58.

Repos can be signed by 4096-bit keys.

4096-bit keys are supported on OpenPGP mode but not on PIV (What we currently use).