Ver código fonte

Reduce the calculation time for dhparams

Otherwise it just takes too long on the beaglebone
Bob Mottram 9 anos atrás
pai
commit
caf1f53dd2
4 arquivos alterados com 9 adições e 14 exclusões
  1. 1
    1
      doc/EN/beaglebone.txt
  2. 1
    1
      src/freedombone-addcert
  3. 0
    5
      src/freedombone-config
  4. 7
    7
      src/freedombone-sec

+ 1
- 1
doc/EN/beaglebone.txt Ver arquivo

1650
   -keyout /etc/ssl/private/$HOSTNAME.key \
1650
   -keyout /etc/ssl/private/$HOSTNAME.key \
1651
   -out /etc/ssl/certs/$HOSTNAME.crt
1651
   -out /etc/ssl/certs/$HOSTNAME.crt
1652
 
1652
 
1653
-openssl dhparam -check -text -5 2048 -out /etc/ssl/certs/$HOSTNAME.dhparam
1653
+openssl dhparam -check -text -dsaparam 2048 -out /etc/ssl/certs/$HOSTNAME.dhparam
1654
 
1654
 
1655
 chmod 400 /etc/ssl/private/$HOSTNAME.key
1655
 chmod 400 /etc/ssl/private/$HOSTNAME.key
1656
 chmod 640 /etc/ssl/certs/$HOSTNAME.crt
1656
 chmod 640 /etc/ssl/certs/$HOSTNAME.crt

+ 1
- 1
src/freedombone-addcert Ver arquivo

218
 # generate DH params
218
 # generate DH params
219
 if [ ! $NODH ]; then
219
 if [ ! $NODH ]; then
220
 	if [ ! -f /etc/ssl/certs/$CERTFILE.dhparam ]; then
220
 	if [ ! -f /etc/ssl/certs/$CERTFILE.dhparam ]; then
221
-		openssl dhparam -check -text -5 $DH_KEYLENGTH -out /etc/ssl/certs/$CERTFILE.dhparam
221
+		openssl dhparam -check -text -dsaparam $DH_KEYLENGTH -out /etc/ssl/certs/$CERTFILE.dhparam
222
 		chmod 640 /etc/ssl/certs/$CERTFILE.dhparam
222
 		chmod 640 /etc/ssl/certs/$CERTFILE.dhparam
223
 	fi
223
 	fi
224
 fi
224
 fi

+ 0
- 5
src/freedombone-config Ver arquivo

763
         esac
763
         esac
764
         if [[ $INSTALLING_ON_BBB == "yes" ]]; then
764
         if [[ $INSTALLING_ON_BBB == "yes" ]]; then
765
             USB_DRIVE=/dev/sda1
765
             USB_DRIVE=/dev/sda1
766
-            # here a short diffie-hellman key length is used, because otherwise creation of keys
767
-            # becomes impractically long on the beaglebone. It is known (as of 2015) that
768
-            # 1024bit DH may be breakable, so this is really a tradeoff between security and the
769
-            # available hardware
770
-            DH_KEYLENGTH=1024
771
         fi
766
         fi
772
         save_configuration_file
767
         save_configuration_file
773
     fi
768
     fi

+ 7
- 7
src/freedombone-sec Ver arquivo

351
       dialog --backtitle "Freedombone Security Configuration" \
351
       dialog --backtitle "Freedombone Security Configuration" \
352
              --title "Diffie-Hellman key length" \
352
              --title "Diffie-Hellman key length" \
353
              --radiolist "The smaller length is better suited to low power embedded systems:" 12 40 3 \
353
              --radiolist "The smaller length is better suited to low power embedded systems:" 12 40 3 \
354
-             1 "1024 bits (WARNING: this may be insecure)" off \
355
-             2 "2048 bits" on \
356
-             3 "3072 bits" off 2> $data
354
+             1 "2048 bits" off \
355
+             2 "3072 bits" on \
356
+             3 "4096 bits" off 2> $data
357
       sel=$?
357
       sel=$?
358
       case $sel in
358
       case $sel in
359
           1) exit 1;;
359
           1) exit 1;;
360
           255) exit 1;;
360
           255) exit 1;;
361
       esac
361
       esac
362
       case $(cat $data) in
362
       case $(cat $data) in
363
-          1) DH_KEYLENGTH=1024;;
364
-          2) DH_KEYLENGTH=2048;;
365
-          3) DH_KEYLENGTH=3072;;
363
+          1) DH_KEYLENGTH=2048;;
364
+          2) DH_KEYLENGTH=3072;;
365
+          3) DH_KEYLENGTH=4096;;
366
       esac
366
       esac
367
 
367
 
368
       ctr=0
368
       ctr=0
371
           if [[ -f $file ]]; then
371
           if [[ -f $file ]]; then
372
               filename=/etc/ssl/certs/$(echo $file | awk -F '/etc/ssl/mycerts/' '{print $2}' | awk -F '.crt' '{print $1}').dhparam
372
               filename=/etc/ssl/certs/$(echo $file | awk -F '/etc/ssl/mycerts/' '{print $2}' | awk -F '.crt' '{print $1}').dhparam
373
               if [ -f $filename ]; then
373
               if [ -f $filename ]; then
374
-                  openssl dhparam -check -text -5 $DH_KEYLENGTH -out $filename
374
+                  openssl dhparam -check -text -dsaparam $DH_KEYLENGTH -out $filename
375
                   ctr=$((ctr + 1))
375
                   ctr=$((ctr + 1))
376
               fi
376
               fi
377
           fi
377
           fi