From d5018c6af182a0aeabdf1350975f1e855566e1fb Mon Sep 17 00:00:00 2001 From: stilez Date: Sun, 8 May 2016 05:11:18 +0100 Subject: [PATCH 1/4] Add missing recommended key lengths to user manager Add key lengths to user manager options --- src/usr/local/www/system_usermanager.php | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/usr/local/www/system_usermanager.php b/src/usr/local/www/system_usermanager.php index 2df24be53e..83dbbf1c92 100644 --- a/src/usr/local/www/system_usermanager.php +++ b/src/usr/local/www/system_usermanager.php @@ -805,9 +805,14 @@ if ($act == "new" || $act == "edit" || $input_errors): 512 => '512 bits', 1024 => '1024 bits', 2048 => '2048 bits', + 3072 => '3072 bits', 4096 => '4096 bits', + 7680 => '7680 bits', + 8192 => '8192 bits', + 15360 => '15360 bits', + 16384 => '16384 bits' ) - )); + ))->setHelp('The larger the key, the more security it offers, but larger keys take considerably more time to generate, and take slightly longer to validate leading to a slight slowdown in setting up new sessions (not always noticeable). As of 2016, 2048 bit is the minimum and most common selection and 4096 is the maximum in common use. For more information see <a href="https://keylength.com">keylength.com</a>.'); $section->addInput(new Form_Input( 'lifetime', @@ -904,4 +909,4 @@ events.push(function() { \ No newline at end of file +?> From 5065aa44497f99530d1b1e91eaab48e70a5e2375 Mon Sep 17 00:00:00 2001 From: stilez Date: Sun, 8 May 2016 05:17:16 +0100 Subject: [PATCH 2/4] Add missing recommended key lengths/digest to certmanager --- src/usr/local/www/system_certmanager.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/usr/local/www/system_certmanager.php b/src/usr/local/www/system_certmanager.php index 51d3ed671b..cebda6dbfa 100644 --- a/src/usr/local/www/system_certmanager.php +++ b/src/usr/local/www/system_certmanager.php @@ -70,13 +70,13 @@ $cert_methods = array( "external" => gettext("Create a Certificate Signing Request"), ); -$cert_keylens = array("512", "1024", "2048", "4096"); +$cert_keylens = array("512", "1024", "2048", "3072", "4096", "7680", "8192", "15360", "16384"); $cert_types = array( "server" => "Server Certificate", "user" => "User Certificate"); $altname_types = array("DNS", "IP", "email", "URI"); -$openssl_digest_algs = array("sha1", "sha224", "sha256", "sha384", "sha512"); +$openssl_digest_algs = array("sha1", "sha224", "sha256", "sha384", "sha512", "whirlpool"); if (is_numericint($_GET['userid'])) { $userid = $_GET['userid']; From 04c7b6bb2ed7eba89b31ee317f41185f299c7c2c Mon Sep 17 00:00:00 2001 From: stilez Date: Sun, 8 May 2016 05:18:44 +0100 Subject: [PATCH 3/4] Add missing recommended key lengths/digest to ca manager --- src/usr/local/www/system_camanager.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/usr/local/www/system_camanager.php b/src/usr/local/www/system_camanager.php index 3f91fd2aae..84948d508e 100644 --- a/src/usr/local/www/system_camanager.php +++ b/src/usr/local/www/system_camanager.php @@ -69,8 +69,8 @@ $ca_methods = array( "internal" => gettext("Create an internal Certificate Authority"), "intermediate" => gettext("Create an intermediate Certificate Authority")); -$ca_keylens = array("512", "1024", "2048", "4096"); -$openssl_digest_algs = array("sha1", "sha224", "sha256", "sha384", "sha512"); +$ca_keylens = array("512", "1024", "2048", "3072", "4096", "7680", "8192", "15360", "16384"); +$openssl_digest_algs = array("sha1", "sha224", "sha256", "sha384", "sha512", "whirlpool"); if (is_numericint($_GET['id'])) { $id = $_GET['id']; From 62a9863c1830ea36c5de4880426b2c8f1ddd9c5c Mon Sep 17 00:00:00 2001 From: stilez Date: Sun, 8 May 2016 05:19:52 +0100 Subject: [PATCH 4/4] Add missing recommended digest --- src/etc/inc/certs.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/etc/inc/certs.inc b/src/etc/inc/certs.inc index d49f4780be..5511400f11 100644 --- a/src/etc/inc/certs.inc +++ b/src/etc/inc/certs.inc @@ -56,7 +56,7 @@ define("OPEN_SSL_CONF_PATH", "/etc/ssl/openssl.cnf"); require_once("functions.inc"); global $openssl_digest_algs; -$openssl_digest_algs = array("sha1", "sha224", "sha256", "sha384", "sha512"); +$openssl_digest_algs = array("sha1", "sha224", "sha256", "sha384", "sha512", "whirlpool"); global $openssl_crl_status; $openssl_crl_status = array(