Skip to content

Remove the RSA key size checker in /crypto/tls/boring.go #774

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
zihanhan1203 opened this issue Oct 13, 2022 · 2 comments
Closed

Remove the RSA key size checker in /crypto/tls/boring.go #774

zihanhan1203 opened this issue Oct 13, 2022 · 2 comments

Comments

@zihanhan1203
Copy link

Background
This line of code in /crypto/tls/boring.go limit the RSA key size to 2048 and 3072, which will cause an issue when we try to establish a TLS connection to the server with 4096 key size. There is an open issue to the official go golang/go#41147 discussing about this. So we are seeking for a go version which replace the boring go with the openssl, and we found this repo.

Issue
However, we found that you didn't patch to the boring.go file I mentioned above, so we will still meet the same problem by using this go version.

Request
Is it possible you can add a patch to that boring.go file to remove or modify the RSA key size checker? It is safe to do it because we are now relying on the underlying openssl to be FIPS compliant, right?

@qmuntal
Copy link
Member

qmuntal commented Nov 4, 2022

Recent news: Upstream will probably land 4096 RSA key size support on go1.20: golang/go#41147 (comment).

@qmuntal
Copy link
Member

qmuntal commented Nov 15, 2022

Upstream implemented this and backported it to go1.18 and go1.19, so our fork will benefit from that too. We can close this.

@qmuntal qmuntal closed this as completed Nov 15, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants