diff options
| author | sthen <> | 2014-10-01 13:15:40 +0000 |
|---|---|---|
| committer | sthen <> | 2014-10-01 13:15:40 +0000 |
| commit | 5c5b544c2aae06ec114cfeaf631cd09a331ce9ea (patch) | |
| tree | 67663f7db6cba735d8fc6ce3333a938521b78ff7 /src/usr.bin | |
| parent | 4196588ba36e0ba5fa0fcb814fd943e5e3e60b62 (diff) | |
| download | openbsd-5c5b544c2aae06ec114cfeaf631cd09a331ce9ea.tar.gz openbsd-5c5b544c2aae06ec114cfeaf631cd09a331ce9ea.tar.bz2 openbsd-5c5b544c2aae06ec114cfeaf631cd09a331ce9ea.zip | |
Switch "openssl req" to using SHA256 for hashes and AES256 to encrypt on-disk
keys by default (instead of SHA1/3DES) and update documentation to match.
Another way to do this is s/NID_sha1/NID_sha256/ in src/crypto/rsa/rsa_ameth.c
("case ASN1_PKEY_CTRL_DEFAULT_MD_NID") but going with the more targetted method
above that only affects "openssl req" for now.
Help/OK jsing@. OKs on earlier diffs changing openssl.cnf from phessler@ aja@
Diffstat (limited to 'src/usr.bin')
| -rw-r--r-- | src/usr.bin/openssl/openssl.1 | 15 | ||||
| -rw-r--r-- | src/usr.bin/openssl/req.c | 9 |
2 files changed, 12 insertions, 12 deletions
diff --git a/src/usr.bin/openssl/openssl.1 b/src/usr.bin/openssl/openssl.1 index 7387a2d8ed..23f5fff885 100644 --- a/src/usr.bin/openssl/openssl.1 +++ b/src/usr.bin/openssl/openssl.1 | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | .\" $OpenBSD: openssl.1,v 1.3 2014/09/16 16:05:44 jmc Exp $ | 1 | .\" $OpenBSD: openssl.1,v 1.4 2014/10/01 13:15:40 sthen Exp $ |
| 2 | .\" ==================================================================== | 2 | .\" ==================================================================== |
| 3 | .\" Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. | 3 | .\" Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. |
| 4 | .\" | 4 | .\" |
| @@ -112,7 +112,7 @@ | |||
| 112 | .\" | 112 | .\" |
| 113 | .\" OPENSSL | 113 | .\" OPENSSL |
| 114 | .\" | 114 | .\" |
| 115 | .Dd $Mdocdate: September 16 2014 $ | 115 | .Dd $Mdocdate: October 1 2014 $ |
| 116 | .Dt OPENSSL 1 | 116 | .Dt OPENSSL 1 |
| 117 | .Os | 117 | .Os |
| 118 | .Sh NAME | 118 | .Sh NAME |
| @@ -5583,7 +5583,7 @@ This gives the | |||
| 5583 | to write the newly created private key to. | 5583 | to write the newly created private key to. |
| 5584 | If this option is not specified, the filename present in the | 5584 | If this option is not specified, the filename present in the |
| 5585 | configuration file is used. | 5585 | configuration file is used. |
| 5586 | .It Fl md4 | md5 | sha1 | 5586 | .It Fl md5 | sha1 | sha256 |
| 5587 | This specifies the message digest to sign the request with. | 5587 | This specifies the message digest to sign the request with. |
| 5588 | This overrides the digest algorithm specified in the configuration file. | 5588 | This overrides the digest algorithm specified in the configuration file. |
| 5589 | .Pp | 5589 | .Pp |
| @@ -5774,7 +5774,7 @@ They are currently ignored by | |||
| 5774 | request signing utilities, but some CAs might want them. | 5774 | request signing utilities, but some CAs might want them. |
| 5775 | .It Ar default_bits | 5775 | .It Ar default_bits |
| 5776 | This specifies the default key size in bits. | 5776 | This specifies the default key size in bits. |
| 5777 | If not specified, 512 is used. | 5777 | If not specified, 2048 is used. |
| 5778 | It is used if the | 5778 | It is used if the |
| 5779 | .Fl new | 5779 | .Fl new |
| 5780 | option is used. | 5780 | option is used. |
| @@ -5790,10 +5790,11 @@ option. | |||
| 5790 | .It Ar default_md | 5790 | .It Ar default_md |
| 5791 | This option specifies the digest algorithm to use. | 5791 | This option specifies the digest algorithm to use. |
| 5792 | Possible values include | 5792 | Possible values include |
| 5793 | .Ar md5 | 5793 | .Ar md5 , |
| 5794 | .Ar sha1 | ||
| 5794 | and | 5795 | and |
| 5795 | .Ar sha1 . | 5796 | .Ar sha256 . |
| 5796 | If not present, MD5 is used. | 5797 | If not present, SHA256 is used. |
| 5797 | This option can be overridden on the command line. | 5798 | This option can be overridden on the command line. |
| 5798 | .It Ar distinguished_name | 5799 | .It Ar distinguished_name |
| 5799 | This specifies the section containing the distinguished name fields to | 5800 | This specifies the section containing the distinguished name fields to |
diff --git a/src/usr.bin/openssl/req.c b/src/usr.bin/openssl/req.c index 98f3e1d84c..99f10ecde0 100644 --- a/src/usr.bin/openssl/req.c +++ b/src/usr.bin/openssl/req.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: req.c,v 1.2 2014/08/28 14:23:52 jsing Exp $ */ | 1 | /* $OpenBSD: req.c,v 1.3 2014/10/01 13:15:40 sthen Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -97,7 +97,7 @@ | |||
| 97 | #define STRING_MASK "string_mask" | 97 | #define STRING_MASK "string_mask" |
| 98 | #define UTF8_IN "utf8" | 98 | #define UTF8_IN "utf8" |
| 99 | 99 | ||
| 100 | #define DEFAULT_KEY_LENGTH 512 | 100 | #define DEFAULT_KEY_LENGTH 2048 |
| 101 | #define MIN_KEY_LENGTH 384 | 101 | #define MIN_KEY_LENGTH 384 |
| 102 | 102 | ||
| 103 | 103 | ||
| @@ -184,9 +184,8 @@ req_main(int argc, char **argv) | |||
| 184 | unsigned long chtype = MBSTRING_ASC; | 184 | unsigned long chtype = MBSTRING_ASC; |
| 185 | 185 | ||
| 186 | req_conf = NULL; | 186 | req_conf = NULL; |
| 187 | #ifndef OPENSSL_NO_DES | 187 | cipher = EVP_aes_256_cbc(); |
| 188 | cipher = EVP_des_ede3_cbc(); | 188 | digest = EVP_sha256(); |
| 189 | #endif | ||
| 190 | 189 | ||
| 191 | infile = NULL; | 190 | infile = NULL; |
| 192 | outfile = NULL; | 191 | outfile = NULL; |