зеркало из https://github.com/github/ruby.git
543dd74049
We use dh2048_ffdhe2048.pem file (DH 2048 bits) instead of dh1024.pem file in both non-FIPS and FIPS cases. Because the following command fails to generate the pem file with 1024 bits. And the OpenSSL FIPS 140-2 security policy document explains the DH public keys are allowed from 2048 bits.[1] ``` $ OPENSSL_CONF=/home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/ssl/openssl_fips.cnf \ /home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/bin/openssl \ dhparam -out dh1024.pem 1024 Generating DH parameters, 1024 bit long safe prime dhparam: Generating DH key parameters failed ``` The dh2048_ffdhe2048.pem file was created by the following command with the OpenSSL FIPS configuration file. The logic to generate the DH pem file is different between non-FIPS and FIPS cases. In FIPS, it seems that the command always returns the text defined as ffdhe2048 in the FFDHE groups in RFC 7919 unlike non-FIPS.[2] As the generated pem file is a normal and valid PKCS#3-style group parameter, we use the file for the non-FIPS case too. ``` $ OPENSSL_CONF=/home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/ssl/openssl_fips.cnf \ /home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/bin/openssl \ dhparam -out dh2048_ffdhe2048.pem 2048 ``` Note that the hard-coded PEM-encoded string in the `test_DHparams` is intentional to avoid modifying the content unintentionally. * [1] https://www.openssl.org/source/ - OpenSSL 3.0.8 FIPS 140-2 security policy document page 25, Table 10 – Public Keys - DH Public - DH (2048/3072/4096/6144/8192) public key agreement key * [2] RFC7919 - Appendix A.1: ffdhe2048 https://www.rfc-editor.org/rfc/rfc7919#appendix-A.1 |
||
|---|---|---|
| .. | ||
| fixtures/pkey | ||
| test_asn1.rb | ||
| test_bn.rb | ||
| test_buffering.rb | ||
| test_cipher.rb | ||
| test_config.rb | ||
| test_digest.rb | ||
| test_engine.rb | ||
| test_fips.rb | ||
| test_hmac.rb | ||
| test_kdf.rb | ||
| test_ns_spki.rb | ||
| test_ocsp.rb | ||
| test_ossl.rb | ||
| test_pair.rb | ||
| test_pkcs7.rb | ||
| test_pkcs12.rb | ||
| test_pkey.rb | ||
| test_pkey_dh.rb | ||
| test_pkey_dsa.rb | ||
| test_pkey_ec.rb | ||
| test_pkey_rsa.rb | ||
| test_provider.rb | ||
| test_random.rb | ||
| test_ssl.rb | ||
| test_ssl_session.rb | ||
| test_ts.rb | ||
| test_x509attr.rb | ||
| test_x509cert.rb | ||
| test_x509crl.rb | ||
| test_x509ext.rb | ||
| test_x509name.rb | ||
| test_x509req.rb | ||
| test_x509store.rb | ||
| ut_eof.rb | ||
| utils.rb | ||