randombit
commented
6 years ago -
For RSA you will almost certainly want to also enable
emsa_pkcs1since in practice almost all X.509 RSA certificates are signed with that format. You might want to also enable SHA-384/SHA-512 (sha2_64) since those are sometimes used in ECDSA certificates. -
Unfortunately it's not possible to further disable beyond what is being configured above. A lot of what is being pulled in (cbc, block, pbkdf2 etc) is because the public key code depends on
pbes2, which is the encryption scheme used to encrypt private keys. PBES2 in turn pulls in PBKDF2, CBC, etc. If you are going to encrypt private keys, PBES2 is required. However, if you are not it is kind of a bunch of dead weight. It turns out to be easy to make PBES2 optional, and just disable encryption/decryption of private keys in that case. (#1417)
DevSidious
neusdan
Premises:
I need to generate a custom build of Botan, aimed at X509 certificate manipulation. I want to load, inspect and validate existing certificates, as well as generate and save new ones. Of utmost importnace is the ability to support both RSA and ECC keys.
After fiddling with configure.py for a while I reached this combination of flags:
C:\Git\botan>configure.py --cc=msvc --os=windows --minimized-build --enable-modules=x509,ecdsa,rsa --amalgamation --single-amalgamation-file --prefix="C:\Botan"
INFO: Skipping (incompatible OS): darwin_secrandom dev_random fd_unix getentropy proc_walk
INFO: Skipping (incompatible compiler): aes_armv8 pmull sha1_armv8 sha1_x86 sha2_32_armv8 sha2_32_x86 shacal2_x86
INFO: Skipping (not requested): adler32 aead aes aes_ni aes_ssse3 aont aria auto_rng bcrypt blake2 blowfish camellia cascade cast cbc_mac ccm cecpq1 certstor_sql certstor_sqlite3 cfb chacha chacha20poly1305 chacha_rng chacha_sse2 clmul clmul_ssse3 cmac codec_filt comb4p compression crc24 crc32 cryptobox ctr curve25519 des dh dl_algo dl_group dlies dsa dyn_load eax ecdh ecgdsa ecies eckcdsa ed25519 elgamal eme_oaep eme_pkcs1 eme_raw emsa_pkcs1 emsa_raw emsa_x931 ffi filters fpe_fe1 gcm gmac gost_28147 gost_3410 gost_3411 hash_id hkdf hmac_drbg hotp http_util idea idea_sse2 iso9796 kasumi kdf1 kdf1_iso18033 kdf2 keccak lion locking_allocator mce mceies md4 md5 misty1 newhope nist_keywrap noekeon noekeon_simd ocb ofb par_hash passhash9 pbkdf1 pgp_s2k pkcs11 poly1305 poly_dbl prf_tls prf_x942 psk_db rc4 rdrand rdrand_rng rdseed rfc3394 rfc6979 rmd160 salsa20 seed serpent serpent_simd sessions_sql sessions_sqlite3 sha1_sse2 sha2_64 sha3 shacal2 shacal2_simd shake shake_cipher simd siphash siv skein sm2 sm3 sm4 socket sp800_108 sp800_56a sp800_56c srp6 stateful_rng streebog system_rng threefish threefish_avx2 tiger tls tls_cbc tss twofish whirlpool win32_stats x919_mac xmss xtea xts
INFO: Skipping (requires external dependency): bearssl boost bzip2 lzma openssl sqlite3 tpm zlib
INFO: Loading modules: asn1 base base64 bigint block cbc cpuid ec_gfp ec_group ecc_key ecdsa emsa1 emsa_pssr entropy hash hex hmac kdf keypair mac mdx_hash mgf1 mode_pad modes mp numbertheory pbes2 pbkdf pbkdf2 pem pk_pad pubkey rng rsa sha1 sha2_32 stream utils x509
The questions:
Any input would be greatly appreciated.
Thank you.
PS: congratulations to the authors for this excellent library.