Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Rely on OpenPGP.js to forbid using weak algos e.g. RSA1024 etc. #4971

Draft
wants to merge 4 commits into
base: master
Choose a base branch
from

Conversation

rrrooommmaaa
Copy link
Contributor

This PR removes own protection as OpenPGP.js config.minRSABits implicitly has the default value of 2047.

close #4905


Tests (delete all except exactly one):

  • Unit tests are already in place:
    [KeyUtil.diagnose] decrypts and tests secure PK and insecure SK
    [unit][OpenPGPKey.parse] sets usableForEncryption and usableForSigning to false for RSA key less than 2048
    [unit][OpenPGPKey.parse] sets usableForEncryption to false and usableForSigning to true for 2048/RSA PK and 1024/RSA SK
    [unit][OpenPGPKey.decrypt] sets usableForEncryption to false and usableForSigning to true for 2048/RSA PK and 1024/RSA SK

To be filled by reviewers

I have reviewed that this PR... (tick whichever items you personally focused on during this review):

  • addresses the issue it closes (if any)
  • code is readable and understandable
  • is accompanied with tests, or tests are not needed
  • is free of vulnerabilities
  • is documented clearly and usefully, or doesn't need documentation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Use OpenPGP.js v6 native ways to reject algorithms
1 participant