|
 |
d4b2f2 |
From fd17f002b2f4150a1fddc2582a21c6c03933a28a Mon Sep 17 00:00:00 2001
|
|
|
d4b2f2 |
From: Rob Crittenden <rcritten@redhat.com>
|
|
|
d4b2f2 |
Date: Fri, 23 Feb 2018 10:43:44 -0500
|
|
|
d4b2f2 |
Subject: [PATCH] NSS crypto policy sets minimum RSA and DSA key size to 2048
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
Remove keys < 2048 for the NSS tests. This affects some of the
|
|
|
d4b2f2 |
OpenSSL tests as well where they run in a combined loop.
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
Where it was not invasive to do I left the 1024/1536 for OpenSSL.
|
|
|
d4b2f2 |
---
|
|
|
d4b2f2 |
tests/001-keyiread-dsa/expected.out | 6 +++---
|
|
|
d4b2f2 |
tests/001-keyiread-dsa/run.sh | 2 +-
|
|
|
d4b2f2 |
tests/001-keyiread-rsa/expected.out | 2 --
|
|
|
d4b2f2 |
tests/001-keyiread-rsa/run.sh | 2 +-
|
|
|
d4b2f2 |
tests/001-keyiread/expected.out | 2 --
|
|
|
d4b2f2 |
tests/001-keyiread/run.sh | 2 +-
|
|
|
d4b2f2 |
tests/002-keygen-rsa/expected.out | 6 ------
|
|
|
d4b2f2 |
tests/002-keygen-rsa/run.sh | 2 +-
|
|
|
d4b2f2 |
tests/002-keygen/expected.out | 18 ------------------
|
|
|
d4b2f2 |
tests/002-keygen/run.sh | 2 +-
|
|
|
d4b2f2 |
tests/003-csrgen-rsa/expected.out | 6 ------
|
|
|
d4b2f2 |
tests/003-csrgen-rsa/run.sh | 4 ++--
|
|
|
d4b2f2 |
tests/003-csrgen/expected.out | 8 --------
|
|
|
d4b2f2 |
tests/003-csrgen/run.sh | 4 ++--
|
|
|
d4b2f2 |
tests/004-selfsign-rsa/expected.out | 2 --
|
|
|
d4b2f2 |
tests/004-selfsign-rsa/run.sh | 2 +-
|
|
|
d4b2f2 |
tests/004-selfsign/expected.out | 2 --
|
|
|
d4b2f2 |
tests/004-selfsign/run.sh | 2 +-
|
|
|
d4b2f2 |
18 files changed, 14 insertions(+), 60 deletions(-)
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
diff --git a/tests/001-keyiread-dsa/expected.out b/tests/001-keyiread-dsa/expected.out
|
|
|
d4b2f2 |
index b09db0ae..50643176 100644
|
|
|
d4b2f2 |
--- a/tests/001-keyiread-dsa/expected.out
|
|
|
d4b2f2 |
+++ b/tests/001-keyiread-dsa/expected.out
|
|
|
d4b2f2 |
@@ -1,4 +1,4 @@
|
|
|
d4b2f2 |
-OK (DSA:1024).
|
|
|
d4b2f2 |
-OK (DSA:1024).
|
|
|
d4b2f2 |
-OK (DSA:1024).
|
|
|
d4b2f2 |
+OK (DSA:2048).
|
|
|
d4b2f2 |
+OK (DSA:2048).
|
|
|
d4b2f2 |
+OK (DSA:2048).
|
|
|
d4b2f2 |
Test complete.
|
|
|
d4b2f2 |
diff --git a/tests/001-keyiread-dsa/run.sh b/tests/001-keyiread-dsa/run.sh
|
|
|
d4b2f2 |
index 9f96b3bc..68f6d1c3 100755
|
|
|
d4b2f2 |
--- a/tests/001-keyiread-dsa/run.sh
|
|
|
d4b2f2 |
+++ b/tests/001-keyiread-dsa/run.sh
|
|
|
d4b2f2 |
@@ -5,7 +5,7 @@ cd "$tmpdir"
|
|
|
d4b2f2 |
source "$srcdir"/functions
|
|
|
d4b2f2 |
initnssdb "$tmpdir"
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
-for size in 1024 ; do
|
|
|
d4b2f2 |
+for size in 2048 ; do
|
|
|
d4b2f2 |
# Generate a self-signed cert.
|
|
|
d4b2f2 |
run_certutil -d "$tmpdir" -S -g $size -n keyi$size \
|
|
|
d4b2f2 |
-s "cn=T$size" -c "cn=T$size" \
|
|
|
d4b2f2 |
diff --git a/tests/001-keyiread-rsa/expected.out b/tests/001-keyiread-rsa/expected.out
|
|
|
d4b2f2 |
index 727897d1..3daa51f2 100644
|
|
|
d4b2f2 |
--- a/tests/001-keyiread-rsa/expected.out
|
|
|
d4b2f2 |
+++ b/tests/001-keyiread-rsa/expected.out
|
|
|
d4b2f2 |
@@ -1,5 +1,3 @@
|
|
|
d4b2f2 |
-OK (RSA:1024).
|
|
|
d4b2f2 |
-OK (RSA:1536).
|
|
|
d4b2f2 |
OK (RSA:2048).
|
|
|
d4b2f2 |
OK (RSA:3072).
|
|
|
d4b2f2 |
OK (RSA:4096).
|
|
|
d4b2f2 |
diff --git a/tests/001-keyiread-rsa/run.sh b/tests/001-keyiread-rsa/run.sh
|
|
|
d4b2f2 |
index c7b77686..ec31c7c7 100755
|
|
|
d4b2f2 |
--- a/tests/001-keyiread-rsa/run.sh
|
|
|
d4b2f2 |
+++ b/tests/001-keyiread-rsa/run.sh
|
|
|
d4b2f2 |
@@ -5,7 +5,7 @@ cd "$tmpdir"
|
|
|
d4b2f2 |
source "$srcdir"/functions
|
|
|
d4b2f2 |
initnssdb "$tmpdir"
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
-for size in 1024 1536 2048 3072 4096 ; do
|
|
|
d4b2f2 |
+for size in 2048 3072 4096 ; do
|
|
|
d4b2f2 |
# Generate a self-signed cert.
|
|
|
d4b2f2 |
run_certutil -d "$tmpdir" -S -g $size -n keyi$size \
|
|
|
d4b2f2 |
-s "cn=T$size" -c "cn=T$size" \
|
|
|
d4b2f2 |
diff --git a/tests/001-keyiread/expected.out b/tests/001-keyiread/expected.out
|
|
|
d4b2f2 |
index 727897d1..3daa51f2 100644
|
|
|
d4b2f2 |
--- a/tests/001-keyiread/expected.out
|
|
|
d4b2f2 |
+++ b/tests/001-keyiread/expected.out
|
|
|
d4b2f2 |
@@ -1,5 +1,3 @@
|
|
|
d4b2f2 |
-OK (RSA:1024).
|
|
|
d4b2f2 |
-OK (RSA:1536).
|
|
|
d4b2f2 |
OK (RSA:2048).
|
|
|
d4b2f2 |
OK (RSA:3072).
|
|
|
d4b2f2 |
OK (RSA:4096).
|
|
|
d4b2f2 |
diff --git a/tests/001-keyiread/run.sh b/tests/001-keyiread/run.sh
|
|
|
d4b2f2 |
index ce1428ed..0b31df95 100755
|
|
|
d4b2f2 |
--- a/tests/001-keyiread/run.sh
|
|
|
d4b2f2 |
+++ b/tests/001-keyiread/run.sh
|
|
|
d4b2f2 |
@@ -5,7 +5,7 @@ cd "$tmpdir"
|
|
|
d4b2f2 |
source "$srcdir"/functions
|
|
|
d4b2f2 |
initnssdb "$tmpdir"
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
-for size in 1024 1536 2048 3072 4096 ; do
|
|
|
d4b2f2 |
+for size in 2048 3072 4096 ; do
|
|
|
d4b2f2 |
# Generate a self-signed cert.
|
|
|
d4b2f2 |
run_certutil -d "$tmpdir" -S -g $size -n keyi$size \
|
|
|
d4b2f2 |
-s "cn=T$size" -c "cn=T$size" \
|
|
|
d4b2f2 |
diff --git a/tests/002-keygen-rsa/expected.out b/tests/002-keygen-rsa/expected.out
|
|
|
d4b2f2 |
index 3e6e9f3c..f7c146d0 100644
|
|
|
d4b2f2 |
--- a/tests/002-keygen-rsa/expected.out
|
|
|
d4b2f2 |
+++ b/tests/002-keygen-rsa/expected.out
|
|
|
d4b2f2 |
@@ -1,9 +1,3 @@
|
|
|
d4b2f2 |
-[nss:1024]
|
|
|
d4b2f2 |
-OK.
|
|
|
d4b2f2 |
-OK (RSA:1024).
|
|
|
d4b2f2 |
-[nss:1536]
|
|
|
d4b2f2 |
-OK.
|
|
|
d4b2f2 |
-OK (RSA:1536).
|
|
|
d4b2f2 |
[nss:2048]
|
|
|
d4b2f2 |
OK.
|
|
|
d4b2f2 |
OK (RSA:2048).
|
|
|
d4b2f2 |
diff --git a/tests/002-keygen-rsa/run.sh b/tests/002-keygen-rsa/run.sh
|
|
|
d4b2f2 |
index 476f4127..c0c59249 100755
|
|
|
d4b2f2 |
--- a/tests/002-keygen-rsa/run.sh
|
|
|
d4b2f2 |
+++ b/tests/002-keygen-rsa/run.sh
|
|
|
d4b2f2 |
@@ -5,7 +5,7 @@ cd "$tmpdir"
|
|
|
d4b2f2 |
source "$srcdir"/functions
|
|
|
d4b2f2 |
initnssdb "$tmpdir"
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
-for size in 1024 1536 2048 3072 4096 ; do
|
|
|
d4b2f2 |
+for size in 2048 3072 4096 ; do
|
|
|
d4b2f2 |
echo "[nss:$size]"
|
|
|
d4b2f2 |
# Generate a key.
|
|
|
d4b2f2 |
cat > entry.$size <<- EOF
|
|
|
d4b2f2 |
diff --git a/tests/002-keygen/expected.out b/tests/002-keygen/expected.out
|
|
|
d4b2f2 |
index dcd1af06..b8fbea56 100644
|
|
|
d4b2f2 |
--- a/tests/002-keygen/expected.out
|
|
|
d4b2f2 |
+++ b/tests/002-keygen/expected.out
|
|
|
d4b2f2 |
@@ -1,21 +1,3 @@
|
|
|
d4b2f2 |
-[nss:1024]
|
|
|
d4b2f2 |
-OK.
|
|
|
d4b2f2 |
-OK (RSA:1024).
|
|
|
d4b2f2 |
-OK.
|
|
|
d4b2f2 |
-OK (RSA:1024 after RSA:1024).
|
|
|
d4b2f2 |
-OK.
|
|
|
d4b2f2 |
-OK (RSA:1024 after RSA:1024).
|
|
|
d4b2f2 |
-keyi1024
|
|
|
d4b2f2 |
-keyi1024 (candidate (next))
|
|
|
d4b2f2 |
-[nss:1536]
|
|
|
d4b2f2 |
-OK.
|
|
|
d4b2f2 |
-OK (RSA:1536).
|
|
|
d4b2f2 |
-OK.
|
|
|
d4b2f2 |
-OK (RSA:1536 after RSA:1536).
|
|
|
d4b2f2 |
-OK.
|
|
|
d4b2f2 |
-OK (RSA:1536 after RSA:1536).
|
|
|
d4b2f2 |
-keyi1536
|
|
|
d4b2f2 |
-keyi1536 (candidate (next))
|
|
|
d4b2f2 |
[nss:2048]
|
|
|
d4b2f2 |
OK.
|
|
|
d4b2f2 |
OK (RSA:2048).
|
|
|
d4b2f2 |
diff --git a/tests/002-keygen/run.sh b/tests/002-keygen/run.sh
|
|
|
d4b2f2 |
index 08af1523..94230e6f 100755
|
|
|
d4b2f2 |
--- a/tests/002-keygen/run.sh
|
|
|
d4b2f2 |
+++ b/tests/002-keygen/run.sh
|
|
|
d4b2f2 |
@@ -7,7 +7,7 @@ scheme="${scheme:-dbm:}"
|
|
|
d4b2f2 |
source "$srcdir"/functions
|
|
|
d4b2f2 |
initnssdb "$scheme$tmpdir"
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
-for size in 1024 1536 2048 3072 4096 ; do
|
|
|
d4b2f2 |
+for size in 2048 3072 4096 ; do
|
|
|
d4b2f2 |
echo "[nss:$size]"
|
|
|
d4b2f2 |
# Generate a key.
|
|
|
d4b2f2 |
cat > entry.$size <<- EOF
|
|
|
d4b2f2 |
diff --git a/tests/003-csrgen-rsa/expected.out b/tests/003-csrgen-rsa/expected.out
|
|
|
d4b2f2 |
index c9dec729..def53fe4 100644
|
|
|
d4b2f2 |
--- a/tests/003-csrgen-rsa/expected.out
|
|
|
d4b2f2 |
+++ b/tests/003-csrgen-rsa/expected.out
|
|
|
d4b2f2 |
@@ -1,10 +1,4 @@
|
|
|
d4b2f2 |
pk12util: PKCS12 EXPORT SUCCESSFUL
|
|
|
d4b2f2 |
-1024 OK.
|
|
|
d4b2f2 |
-Signature OK
|
|
|
d4b2f2 |
-pk12util: PKCS12 EXPORT SUCCESSFUL
|
|
|
d4b2f2 |
-1536 OK.
|
|
|
d4b2f2 |
-Signature OK
|
|
|
d4b2f2 |
-pk12util: PKCS12 EXPORT SUCCESSFUL
|
|
|
d4b2f2 |
2048 OK.
|
|
|
d4b2f2 |
Signature OK
|
|
|
d4b2f2 |
pk12util: PKCS12 EXPORT SUCCESSFUL
|
|
|
d4b2f2 |
diff --git a/tests/003-csrgen-rsa/run.sh b/tests/003-csrgen-rsa/run.sh
|
|
|
d4b2f2 |
index 4cd84084..bb8ebecb 100755
|
|
|
d4b2f2 |
--- a/tests/003-csrgen-rsa/run.sh
|
|
|
d4b2f2 |
+++ b/tests/003-csrgen-rsa/run.sh
|
|
|
d4b2f2 |
@@ -5,7 +5,7 @@ cd "$tmpdir"
|
|
|
d4b2f2 |
source "$srcdir"/functions
|
|
|
d4b2f2 |
initnssdb "$tmpdir"
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
-for size in 1024 1536 2048 3072 4096 ; do
|
|
|
d4b2f2 |
+for size in 2048 3072 4096 ; do
|
|
|
d4b2f2 |
# Build a self-signed certificate.
|
|
|
d4b2f2 |
run_certutil -d "$tmpdir" -S -g $size -n keyi$size \
|
|
|
d4b2f2 |
-s "cn=T$size" -c "cn=T$size" \
|
|
|
d4b2f2 |
@@ -147,7 +147,7 @@ iterate() {
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
iteration=1
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
-for size in 1024 ; do
|
|
|
d4b2f2 |
+for size in 2048 ; do
|
|
|
d4b2f2 |
iterate "$size" "$subject" "$hostname" "$email" "$principal" "$ku" "$eku" "$challengepassword" "$certfname" "$ca" "$capathlen" "$crldp" "$ocsp" "$nscomment"
|
|
|
d4b2f2 |
done
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
diff --git a/tests/003-csrgen/expected.out b/tests/003-csrgen/expected.out
|
|
|
d4b2f2 |
index 8e6cac6e..04342c0f 100644
|
|
|
d4b2f2 |
--- a/tests/003-csrgen/expected.out
|
|
|
d4b2f2 |
+++ b/tests/003-csrgen/expected.out
|
|
|
d4b2f2 |
@@ -1,13 +1,5 @@
|
|
|
d4b2f2 |
pk12util: PKCS12 EXPORT SUCCESSFUL
|
|
|
d4b2f2 |
Signature OK
|
|
|
d4b2f2 |
-minicert.openssl.1024.pem: OK
|
|
|
d4b2f2 |
-1024 OK.
|
|
|
d4b2f2 |
-pk12util: PKCS12 EXPORT SUCCESSFUL
|
|
|
d4b2f2 |
-Signature OK
|
|
|
d4b2f2 |
-minicert.openssl.1536.pem: OK
|
|
|
d4b2f2 |
-1536 OK.
|
|
|
d4b2f2 |
-pk12util: PKCS12 EXPORT SUCCESSFUL
|
|
|
d4b2f2 |
-Signature OK
|
|
|
d4b2f2 |
minicert.openssl.2048.pem: OK
|
|
|
d4b2f2 |
2048 OK.
|
|
|
d4b2f2 |
pk12util: PKCS12 EXPORT SUCCESSFUL
|
|
|
d4b2f2 |
diff --git a/tests/003-csrgen/run.sh b/tests/003-csrgen/run.sh
|
|
|
d4b2f2 |
index 7c169ed9..31466b5c 100755
|
|
|
d4b2f2 |
--- a/tests/003-csrgen/run.sh
|
|
|
d4b2f2 |
+++ b/tests/003-csrgen/run.sh
|
|
|
d4b2f2 |
@@ -5,7 +5,7 @@ cd "$tmpdir"
|
|
|
d4b2f2 |
source "$srcdir"/functions
|
|
|
d4b2f2 |
initnssdb "$tmpdir"
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
-for size in 1024 1536 2048 3072 4096 ; do
|
|
|
d4b2f2 |
+for size in 2048 3072 4096 ; do
|
|
|
d4b2f2 |
# Build a self-signed certificate.
|
|
|
d4b2f2 |
run_certutil -d "$tmpdir" -S -g $size -n keyi$size \
|
|
|
d4b2f2 |
-s "cn=T$size" -c "cn=T$size" \
|
|
|
d4b2f2 |
@@ -199,7 +199,7 @@ iterate() {
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
iteration=1
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
-for size in 1024 ; do
|
|
|
d4b2f2 |
+for size in 2048 ; do
|
|
|
d4b2f2 |
iterate "$size" "$subject" "$hostname" "$email" "$principal" "$ku" "$eku" "$challengepassword" "$certfname" "$ca" "$capathlen" "$crldp" "$ocsp" "$nscomment" "$subjectder" "$ipaddress" "$freshestcrl" "$no_ocsp_check" "$profile" "$ns_certtype"
|
|
|
d4b2f2 |
done
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
diff --git a/tests/004-selfsign-rsa/expected.out b/tests/004-selfsign-rsa/expected.out
|
|
|
d4b2f2 |
index dd5029ec..0eb84ef1 100644
|
|
|
d4b2f2 |
--- a/tests/004-selfsign-rsa/expected.out
|
|
|
d4b2f2 |
+++ b/tests/004-selfsign-rsa/expected.out
|
|
|
d4b2f2 |
@@ -1,5 +1,3 @@
|
|
|
d4b2f2 |
-1024 OK.
|
|
|
d4b2f2 |
-1536 OK.
|
|
|
d4b2f2 |
2048 OK.
|
|
|
d4b2f2 |
3072 OK.
|
|
|
d4b2f2 |
4096 OK.
|
|
|
d4b2f2 |
diff --git a/tests/004-selfsign-rsa/run.sh b/tests/004-selfsign-rsa/run.sh
|
|
|
d4b2f2 |
index 6f9285b6..c1dd4c80 100755
|
|
|
d4b2f2 |
--- a/tests/004-selfsign-rsa/run.sh
|
|
|
d4b2f2 |
+++ b/tests/004-selfsign-rsa/run.sh
|
|
|
d4b2f2 |
@@ -33,7 +33,7 @@ function setupca() {
|
|
|
d4b2f2 |
EOF
|
|
|
d4b2f2 |
}
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
-for size in 1024 1536 2048 3072 4096 ; do
|
|
|
d4b2f2 |
+for size in 2048 3072 4096 ; do
|
|
|
d4b2f2 |
# Build a self-signed certificate.
|
|
|
d4b2f2 |
run_certutil -d "$tmpdir" -S -g $size -n keyi$size \
|
|
|
d4b2f2 |
-s "cn=T$size" -c "cn=T$size" \
|
|
|
d4b2f2 |
diff --git a/tests/004-selfsign/expected.out b/tests/004-selfsign/expected.out
|
|
|
d4b2f2 |
index dd5029ec..0eb84ef1 100644
|
|
|
d4b2f2 |
--- a/tests/004-selfsign/expected.out
|
|
|
d4b2f2 |
+++ b/tests/004-selfsign/expected.out
|
|
|
d4b2f2 |
@@ -1,5 +1,3 @@
|
|
|
d4b2f2 |
-1024 OK.
|
|
|
d4b2f2 |
-1536 OK.
|
|
|
d4b2f2 |
2048 OK.
|
|
|
d4b2f2 |
3072 OK.
|
|
|
d4b2f2 |
4096 OK.
|
|
|
d4b2f2 |
diff --git a/tests/004-selfsign/run.sh b/tests/004-selfsign/run.sh
|
|
|
d4b2f2 |
index 7bb368ec..eb1df4ee 100755
|
|
|
d4b2f2 |
--- a/tests/004-selfsign/run.sh
|
|
|
d4b2f2 |
+++ b/tests/004-selfsign/run.sh
|
|
|
d4b2f2 |
@@ -43,7 +43,7 @@ function setupca() {
|
|
|
d4b2f2 |
EOF
|
|
|
d4b2f2 |
}
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
-for size in 1024 1536 2048 3072 4096 ; do
|
|
|
d4b2f2 |
+for size in 2048 3072 4096 ; do
|
|
|
d4b2f2 |
# Build a self-signed certificate.
|
|
|
d4b2f2 |
run_certutil -d "$tmpdir" -S -g $size -n keyi$size \
|
|
|
d4b2f2 |
-s "cn=T$size" -c "cn=T$size" \
|
|
|
d4b2f2 |
--
|
|
|
d4b2f2 |
2.16.2
|
|
|
d4b2f2 |
|