Share encryption key sizes across languages #11192
Conversation
|
QHelp previews: python/ql/src/Security/CWE-326/WeakCryptoKey.qhelpUse of weak cryptographic keyModern encryption relies on it being computationally infeasible to break the cipher and decode a message without the key. As computational power increases, the ability to break ciphers grows and keys need to become larger. The three main asymmetric key algorithms currently in use are Rivest–Shamir–Adleman (RSA) cryptography, Digital Signature Algorithm (DSA), and Elliptic-curve cryptography (ECC). With current technology, key sizes of 2048 bits for RSA and DSA, or 256 bits for ECC, are regarded as unbreakable. RecommendationIncrease the key size to the recommended amount or larger. For RSA or DSA this is at least 2048 bits, for ECC this is at least 256 bits. References
|
| /** Returns the minimum recommended key size for asymmetric algorithms (RSA, DSA, and DH). */ | ||
| int minSecureKeySizeAsymmetricNonEc() { result = 2048 } |
There was a problem hiding this comment.
Only part I'm concerned about it whether minimum secure keysize for RSA/DSA/DH will always be the same. Personally, I would favor a predicate for each, but if you're more informed on this area than me, I'm happy to listen to reason
Draft PR for sharing encryption key sizes between Python and Java.