RT2626: Change default_bits from 1K to 2K

This is a more comprehensive fix.  It changes all
keygen apps to use 2K keys. It also changes the
default to use SHA256 not SHA1.  This is from
Kurt's upstream Debian changes.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
(cherry picked from commit 44e0c2bae4bfd87d770480902618dbccde84fd81)

diff --git a/apps/dhparam.c b/apps/dhparam.c
index f5d7126af7a5d16bedbcb9dc9713f9212e56c189..606365e1805d255433e9b248d82eb1d42439a258 100644 (file)
--- a/apps/dhparam.c
+++ b/apps/dhparam.c
@@ -130,7 +130,7 @@
 #undef PROG
 #define PROG   dhparam_main
 
-#define DEFBITS        512
+#define DEFBITS        2048
 
 /* -inform arg - input format - default PEM (DER or PEM)
  * -outform arg - output format - default PEM
@@ -253,7 +253,7 @@ bad:
                BIO_printf(bio_err," -C            Output C code\n");
                BIO_printf(bio_err," -2            generate parameters using  2 as the generator value\n");
                BIO_printf(bio_err," -5            generate parameters using  5 as the generator value\n");
-               BIO_printf(bio_err," numbits       number of bits in to generate (default 512)\n");
+               BIO_printf(bio_err," numbits       number of bits in to generate (default 2048)\n");
 #ifndef OPENSSL_NO_ENGINE
                BIO_printf(bio_err," -engine e     use engine e, possibly a hardware device.\n");
 #endif

diff --git a/apps/gendh.c b/apps/gendh.c
index 4ec776ba9399a8f3a0b3aeb80b9a78d71410d2c2..8df8c62f8aa3015c231cc685eb336c6655998dce 100644 (file)
--- a/apps/gendh.c
+++ b/apps/gendh.c
@@ -78,7 +78,7 @@
 #include <openssl/x509.h>
 #include <openssl/pem.h>
 
-#define DEFBITS        512
+#define DEFBITS        2048
 #undef PROG
 #define PROG gendh_main
 

diff --git a/apps/genrsa.c b/apps/genrsa.c
index ece114c876a6e76410bc28204329028a901ec9a7..7a8c6c58ad62ba5419ee7b686455a8aead21088c 100644 (file)
--- a/apps/genrsa.c
+++ b/apps/genrsa.c
@@ -78,7 +78,7 @@
 #include <openssl/pem.h>
 #include <openssl/rand.h>
 
-#define DEFBITS        1024
+#define DEFBITS        2048
 #undef PROG
 #define PROG genrsa_main
 

diff --git a/apps/openssl.cnf b/apps/openssl.cnf
index 18760c6e673d76ea7d83995e7b6dc5ec48839adb..1eb86c40126308376e1c6e816d4988badd369fb8 100644 (file)
--- a/apps/openssl.cnf
+++ b/apps/openssl.cnf
@@ -103,7 +103,7 @@ emailAddress                = optional
 
 ####################################################################
 [ req ]
-default_bits           = 1024
+default_bits           = 2048
 default_keyfile        = privkey.pem
 distinguished_name     = req_distinguished_name
 attributes             = req_attributes

diff --git a/crypto/dsa/dsa_ameth.c b/crypto/dsa/dsa_ameth.c
index f89b3c711ca0387129e6a63b31b4a6d3c92c5f07..c46c2640300627f32b46d4d0639f0d860d1119a4 100644 (file)
--- a/crypto/dsa/dsa_ameth.c
+++ b/crypto/dsa/dsa_ameth.c
@@ -638,7 +638,7 @@ static int dsa_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
 #endif
 
                case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
-               *(int *)arg2 = NID_sha1;
+               *(int *)arg2 = NID_sha256;
                return 2;
 
                default:

diff --git a/crypto/ec/ec_ameth.c b/crypto/ec/ec_ameth.c
index fd6d0218d4c083067e0a0a3f3fae073a9d233d63..898b03e40a1e4e7b26c0995853969169f04df383 100644 (file)
--- a/crypto/ec/ec_ameth.c
+++ b/crypto/ec/ec_ameth.c
@@ -633,7 +633,7 @@ static int ec_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
 #endif
 
                case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
-               *(int *)arg2 = NID_sha1;
+               *(int *)arg2 = NID_sha256;
                return 2;
 
                default:

diff --git a/crypto/hmac/hm_ameth.c b/crypto/hmac/hm_ameth.c
index e03f24aedab983b26fb4eb995fdf5ae511c69449..9fe6505bd5a07fc2d76e3ca9bf57351cde3024cc 100644 (file)
--- a/crypto/hmac/hm_ameth.c
+++ b/crypto/hmac/hm_ameth.c
@@ -89,7 +89,7 @@ static int hmac_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
        switch (op)
                {
                case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
-               *(int *)arg2 = NID_sha1;
+               *(int *)arg2 = NID_sha256;
                return 1;
 
                default:

diff --git a/crypto/rsa/rsa_ameth.c b/crypto/rsa/rsa_ameth.c
index c317e8a5dee88d0f1f0fa28d827c1713b75705ad..41bacc874792c362c172fdea558b795c6c2e893a 100644 (file)
--- a/crypto/rsa/rsa_ameth.c
+++ b/crypto/rsa/rsa_ameth.c
@@ -455,7 +455,7 @@ static int rsa_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
 #endif
 
                case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
-               *(int *)arg2 = NID_sha1;
+               *(int *)arg2 = NID_sha256;
                return 1;
 
                default: