diff mbox series

[ima-evm-utils,v3,1/4] Update default key sizes and hash to up-to-date values

Message ID 20230426223559.681668-2-stefanb@linux.ibm.com (mailing list archive)
State New, archived
Headers show
Series Update README and examples and add EC key support | expand

Commit Message

Stefan Berger April 26, 2023, 10:35 p.m. UTC 
Update the documentation and example scripts to use 2048 bit RSA keys
and sha256.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
---
 README                       | 14 +++++++-------
 examples/ima-gen-local-ca.sh |  2 +-
 examples/ima-genkey-self.sh  |  4 ++--
 examples/ima-genkey.sh       |  4 ++--
 4 files changed, 12 insertions(+), 12 deletions(-)
diff mbox series

Patch

diff --git a/README b/README
index 75e4fd2..ae92f95 100644
--- a/README
+++ b/README
@@ -200,11 +200,11 @@  Generate signing and verification keys
 
 Generate private key in plain text format:
 
-    openssl genrsa -out privkey_evm.pem 1024
+    openssl genrsa -out privkey_evm.pem 2048
 
 Generate encrypted private key:
 
-    openssl genrsa -des3 -out privkey_evm.pem 1024
+    openssl genrsa -des3 -out privkey_evm.pem 2048
 
 Make encrypted private key from unencrypted:
 
@@ -213,7 +213,7 @@  Make encrypted private key from unencrypted:
 Generate self-signed X509 public key certificate and private key for using kernel
 asymmetric keys support:
 
-    openssl req -new -nodes -utf8 -sha1 -days 36500 -batch \
+    openssl req -new -nodes -utf8 -sha256 -days 36500 -batch \
     	        -x509 -config x509_evm.genkey \
 	        -outform DER -out x509_evm.der -keyout privkey_evm.pem
 
@@ -221,7 +221,7 @@  Configuration file x509_evm.genkey:
 
 	# Beginning of the file
 	[ req ]
-	default_bits = 1024
+	default_bits = 2048
 	distinguished_name = req_distinguished_name
 	prompt = no
 	string_mask = utf8only
@@ -292,7 +292,7 @@  Configuration file ima-local-ca.genkey:
 
 Generate private key and X509 public key certificate:
 
- openssl req -new -x509 -utf8 -sha1 -days 3650 -batch -config $GENKEY \
+ openssl req -new -x509 -utf8 -sha256 -days 3650 -batch -config $GENKEY \
              -outform DER -out ima-local-ca.x509 -keyout ima-local-ca.priv
 
 Produce X509 in DER format for using while building the kernel:
@@ -303,7 +303,7 @@  Configuration file ima.genkey:
 
 	# Beginning of the file
 	[ req ]
-	default_bits = 1024
+	default_bits = 2048
 	distinguished_name = req_distinguished_name
 	prompt = no
 	string_mask = utf8only
@@ -327,7 +327,7 @@  Configuration file ima.genkey:
 
 Generate private key and X509 public key certificate signing request:
 
- openssl req -new -nodes -utf8 -sha1 -days 365 -batch -config $GENKEY \
+ openssl req -new -nodes -utf8 -sha256 -days 365 -batch -config $GENKEY \
              -out csr_ima.pem -keyout privkey_ima.pem
 
 Sign X509 public key certificate signing request with local IMA CA private key:
diff --git a/examples/ima-gen-local-ca.sh b/examples/ima-gen-local-ca.sh
index 1f24949..055463c 100755
--- a/examples/ima-gen-local-ca.sh
+++ b/examples/ima-gen-local-ca.sh
@@ -22,7 +22,7 @@  authorityKeyIdentifier=keyid:always,issuer
 # keyUsage = cRLSign, keyCertSign
 __EOF__
 
-openssl req -new -x509 -utf8 -sha1 -days 3650 -batch -config $GENKEY \
+openssl req -new -x509 -utf8 -sha256 -days 3650 -batch -config $GENKEY \
 		-outform DER -out ima-local-ca.x509 -keyout ima-local-ca.priv
 
 openssl x509 -inform DER -in ima-local-ca.x509 -out ima-local-ca.pem
diff --git a/examples/ima-genkey-self.sh b/examples/ima-genkey-self.sh
index e293b94..c04df37 100755
--- a/examples/ima-genkey-self.sh
+++ b/examples/ima-genkey-self.sh
@@ -4,7 +4,7 @@  GENKEY=x509_evm.genkey
 
 cat << __EOF__ >$GENKEY
 [ req ]
-default_bits = 1024
+default_bits = 2048
 distinguished_name = req_distinguished_name
 prompt = no
 string_mask = utf8only
@@ -22,7 +22,7 @@  subjectKeyIdentifier=hash
 authorityKeyIdentifier=keyid
 __EOF__
 
-openssl req -x509 -new -nodes -utf8 -sha1 -days 3650 -batch -config $GENKEY \
+openssl req -x509 -new -nodes -utf8 -sha256 -days 3650 -batch -config $GENKEY \
 		-outform DER -out x509_evm.der -keyout privkey_evm.pem
 
 openssl rsa -pubout -in privkey_evm.pem -out pubkey_evm.pem
diff --git a/examples/ima-genkey.sh b/examples/ima-genkey.sh
index b08778f..c09205a 100755
--- a/examples/ima-genkey.sh
+++ b/examples/ima-genkey.sh
@@ -4,7 +4,7 @@  GENKEY=ima.genkey
 
 cat << __EOF__ >$GENKEY
 [ req ]
-default_bits = 1024
+default_bits = 2048
 distinguished_name = req_distinguished_name
 prompt = no
 string_mask = utf8only
@@ -25,7 +25,7 @@  authorityKeyIdentifier=keyid
 #authorityKeyIdentifier=keyid,issuer
 __EOF__
 
-openssl req -new -nodes -utf8 -sha1 -days 365 -batch -config $GENKEY \
+openssl req -new -nodes -utf8 -sha256 -days 365 -batch -config $GENKEY \
 		-out csr_ima.pem -keyout privkey_ima.pem
 openssl x509 -req -in csr_ima.pem -days 365 -extfile $GENKEY -extensions v3_usr \
 		-CA ima-local-ca.pem -CAkey ima-local-ca.priv -CAcreateserial \